@m8t-stack/cli 0.2.83 → 0.2.84

package/dist/cli.js

@@ -1467,7 +1467,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.83";
+var CLI_VERSION = "0.2.84";
 
 // src/lib/render-error.ts
 init_errors();
@@ -3801,12 +3801,12 @@ function encodeURIPath(str4) {
   return str4.replace(/[^A-Za-z0-9\-._~!$&'()*+,;=:@]+/g, encodeURIComponent);
 }
 var EMPTY = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.create(null));
-var createPathTagFunction = (pathEncoder = encodeURIPath) => function path48(statics, ...params) {
+var createPathTagFunction = (pathEncoder = encodeURIPath) => function path47(statics, ...params) {
   if (statics.length === 1)
     return statics[0];
   let postPath = false;
   const invalidSegments = [];
-  const path49 = statics.reduce((previousValue, currentValue, index) => {
+  const path48 = statics.reduce((previousValue, currentValue, index) => {
     if (/[?#]/.test(currentValue)) {
       postPath = true;
     }
@@ -3823,7 +3823,7 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path48(sta
     }
     return previousValue + currentValue + (index === params.length ? "" : encoded);
   }, "");
-  const pathOnly = path49.split(/[?#]/, 1)[0];
+  const pathOnly = path48.split(/[?#]/, 1)[0];
   const invalidSegmentPattern = /(?<=^|\/)(?:\.|%2e){1,2}(?=\/|$)/gi;
   let match;
   while ((match = invalidSegmentPattern.exec(pathOnly)) !== null) {
@@ -3844,10 +3844,10 @@ var createPathTagFunction = (pathEncoder = encodeURIPath) => function path48(sta
     }, "");
     throw new OpenAIError(`Path parameters result in path with invalid segments:
 ${invalidSegments.map((e) => e.error).join("\n")}
-${path49}
+${path48}
 ${underline}`);
   }
-  return path49;
+  return path48;
 };
 var path = /* @__PURE__ */ createPathTagFunction(encodeURIPath);
 
@@ -12298,9 +12298,9 @@ var OpenAI = class {
     this.apiKey = token;
     return true;
   }
-  buildURL(path48, query, defaultBaseURL) {
+  buildURL(path47, query, defaultBaseURL) {
     const baseURL = !__classPrivateFieldGet(this, _OpenAI_instances, "m", _OpenAI_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
-    const url = isAbsoluteURL(path48) ? new URL(path48) : new URL(baseURL + (baseURL.endsWith("/") && path48.startsWith("/") ? path48.slice(1) : path48));
+    const url = isAbsoluteURL(path47) ? new URL(path47) : new URL(baseURL + (baseURL.endsWith("/") && path47.startsWith("/") ? path47.slice(1) : path47));
     const defaultQuery = this.defaultQuery();
     const pathQuery = Object.fromEntries(url.searchParams);
     if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
@@ -12330,24 +12330,24 @@ var OpenAI = class {
    */
   async prepareRequest(request, { url, options }) {
   }
-  get(path48, opts) {
-    return this.methodRequest("get", path48, opts);
+  get(path47, opts) {
+    return this.methodRequest("get", path47, opts);
   }
-  post(path48, opts) {
-    return this.methodRequest("post", path48, opts);
+  post(path47, opts) {
+    return this.methodRequest("post", path47, opts);
   }
-  patch(path48, opts) {
-    return this.methodRequest("patch", path48, opts);
+  patch(path47, opts) {
+    return this.methodRequest("patch", path47, opts);
   }
-  put(path48, opts) {
-    return this.methodRequest("put", path48, opts);
+  put(path47, opts) {
+    return this.methodRequest("put", path47, opts);
   }
-  delete(path48, opts) {
-    return this.methodRequest("delete", path48, opts);
+  delete(path47, opts) {
+    return this.methodRequest("delete", path47, opts);
   }
-  methodRequest(method, path48, opts) {
+  methodRequest(method, path47, opts) {
     return this.request(Promise.resolve(opts).then((opts2) => {
-      return { method, path: path48, ...opts2 };
+      return { method, path: path47, ...opts2 };
     }));
   }
   request(options, remainingRetries = null) {
@@ -12472,8 +12472,8 @@ var OpenAI = class {
     }));
     return { response, options, controller, requestLogID, retryOfRequestLogID, startTime };
   }
-  getAPIList(path48, Page2, opts) {
-    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path48, ...opts2 })) : { method: "get", path: path48, ...opts });
+  getAPIList(path47, Page2, opts) {
+    return this.requestAPIList(Page2, opts && "then" in opts ? opts.then((opts2) => ({ method: "get", path: path47, ...opts2 })) : { method: "get", path: path47, ...opts });
   }
   requestAPIList(Page2, options) {
     const request = this.makeRequest(options, null, void 0);
@@ -12567,8 +12567,8 @@ var OpenAI = class {
   }
   async buildRequest(inputOptions, { retryCount = 0 } = {}) {
     const options = { ...inputOptions };
-    const { method, path: path48, query, defaultBaseURL } = options;
-    const url = this.buildURL(path48, query, defaultBaseURL);
+    const { method, path: path47, query, defaultBaseURL } = options;
+    const url = this.buildURL(path47, query, defaultBaseURL);
     if ("timeout" in options)
       validatePositiveInteger("timeout", options.timeout);
     options.timeout = options.timeout ?? this.timeout;
@@ -13633,10 +13633,10 @@ var BindListCommand = class extends M8tCommand {
     const qs = new URLSearchParams();
     if (this.channel) qs.set("channel", this.channel);
     if (this.status) qs.set("status", this.status);
-    const path48 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
+    const path47 = qs.toString().length > 0 ? `/api/bindings?${qs.toString()}` : "/api/bindings";
     const data = await apiCall(
       { gatewayUrl: ctx.gatewayUrl, gatewayClientId: ctx.gatewayClientId },
-      { method: "GET", path: path48 },
+      { method: "GET", path: path47 },
       (msg) => this.context.stderr.write(msg + "\n")
     );
     if (mode === "json") {
@@ -14882,8 +14882,8 @@ ${r.stderr}`;
         message: `gh api /repos/${slug} failed (exit ${r.exitCode.toString()}): ${(r.stderr || r.stdout).slice(0, 200)}`
       });
     },
-    getFile: async (path48) => {
-      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path48}`]);
+    getFile: async (path47) => {
+      const r = await exec("gh", ["api", "-H", "Accept: application/vnd.github.raw+json", `/repos/${slug}/contents/${path47}`]);
       return r.exitCode === 0 ? r.stdout : null;
     },
     isEmpty: async () => {
@@ -16434,7 +16434,7 @@ function appRepoProbe(args) {
       const res = await doFetch(`${GH_API}/repos/${args.repo}`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status;
     },
-    getFile: (path48) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path48, fetchImpl: args.fetchImpl }),
+    getFile: (path47) => readRepoFileViaApp({ token: args.token, repo: args.repo, path: path47, fetchImpl: args.fetchImpl }),
     isEmpty: async () => {
       const res = await doFetch(`${GH_API}/repos/${args.repo}/contents`, { headers: H, signal: AbortSignal.timeout(GH_REQUEST_TIMEOUT_MS) });
       return res.status === 404;
@@ -20001,6 +20001,7 @@ import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/ident
 
 // src/lib/platform-update.ts
 init_errors();
+import semver from "semver";
 var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-labs/m8t";
 function parseImageRef2(ref) {
   let rest = ref;
@@ -20055,10 +20056,22 @@ function compareSemver(a, b) {
   }
   return 0;
 }
+function comparePlatformVersion(a, b) {
+  const bare = (v) => v.trim().replace(/^platform-/, "").replace(/^v/, "");
+  const va = semver.valid(bare(a));
+  const vb = semver.valid(bare(b));
+  if (!va || !vb) {
+    throw new LocalCliError({
+      code: "PLATFORM_BAD_SEMVER",
+      message: `comparePlatformVersion needs platform versions, got '${a}' / '${b}'.`
+    });
+  }
+  return semver.compare(va, vb);
+}
 function pickNewestSemver(tags) {
-  const semver = tags.filter(isSemverTag);
-  if (semver.length === 0) return null;
-  return semver.reduce((best, t) => compareSemver(t, best) > 0 ? t : best);
+  const semver2 = tags.filter(isSemverTag);
+  if (semver2.length === 0) return null;
+  return semver2.reduce((best, t) => compareSemver(t, best) > 0 ? t : best);
 }
 function parseContainerAppResourceId(id) {
   const m = /\/subscriptions\/([^/]+)\/resourceGroups\/([^/]+)\/providers\/Microsoft\.App\/containerApps\/([^/]+)/i.exec(
@@ -20104,8 +20117,8 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Pass a ghcr.io/<owner>/<name> repo, or use the BYOC private-ACR deploy flow."
     });
   }
-  const path48 = repo.replace(/^ghcr\.io\//, "");
-  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path48}:pull`);
+  const path47 = repo.replace(/^ghcr\.io\//, "");
+  const tokenRes = await fetchImpl(`https://ghcr.io/token?scope=repository:${path47}:pull`);
   if (!tokenRes.ok) {
     throw new LocalCliError({
       code: "PLATFORM_GHCR_TOKEN_FAILED",
@@ -20121,7 +20134,7 @@ async function fetchPublicTags(repo, fetchImpl = fetch) {
       hint: "Make the package public (deploy/ghcr-package-visibility.md), then retry."
     });
   }
-  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path48}/tags/list`, {
+  const tagsRes = await fetchImpl(`https://ghcr.io/v2/${path47}/tags/list`, {
     headers: { Authorization: `Bearer ${token}` }
   });
   if (!tagsRes.ok) {
@@ -20298,6 +20311,8 @@ function entityToStamp(e) {
 var RELEASES_REPO = "m8t-labs/m8t-releases";
 var RELEASES_BASE = `https://github.com/${RELEASES_REPO}/releases`;
 var CHANNEL_LATEST_URL = `${RELEASES_BASE}/latest/download/manifest.json`;
+var CANARY_POINTER_TAG = "canary";
+var CHANNEL_CANARY_URL = `${RELEASES_BASE}/download/${CANARY_POINTER_TAG}/manifest.json`;
 function platformTag(version) {
   const bare = version.trim().replace(/^platform-/, "").replace(/^v/, "");
   return `platform-v${bare}`;
@@ -20309,13 +20324,46 @@ function releaseAssetUrl(tag, asset) {
   return `${RELEASES_BASE}/download/${tag}/${asset}`;
 }
 
+// ../../packages/platform-release/dist/esm/canary-version.js
+var CANARY_IDENTIFIER = "canary";
+var STABLE_CORE = String.raw`\d+\.\d+\.\d+`;
+var CANARY_SUFFIX = String.raw`-${CANARY_IDENTIFIER}\.(?:0|[1-9]\d*)`;
+var CANARY_VERSION_PATTERN = `^${STABLE_CORE}${CANARY_SUFFIX}$`;
+var PLATFORM_VERSION_PATTERN = `^${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
+var PLATFORM_TAG_PATTERN = `^platform-v${STABLE_CORE}(?:${CANARY_SUFFIX})?$`;
+var CANARY_VERSION_RE = new RegExp(CANARY_VERSION_PATTERN);
+var STABLE_CORE_RE = new RegExp(`^${STABLE_CORE}$`);
+
 // ../../packages/platform-release/dist/esm/apply-request.js
 var APPLY_REQUEST_PK = "system";
 var APPLY_REQUEST_RK = "apply-request";
 var IN_FLIGHT = ["claimed", "applying"];
+var LEASE_MS = 30 * 60 * 1e3;
+var MAX_LEASE_TAKEOVERS = 2;
+var MAX_HEALTHY_IN_FLIGHT_MS = LEASE_MS * (MAX_LEASE_TAKEOVERS + 1);
 function isInFlight(status) {
   return IN_FLIGHT.includes(status);
 }
+var BLOCKS_NEW_INTENT = ["pending", "claimed", "applying", "awaiting-engine-update"];
+function blocksNewIntent(status) {
+  return BLOCKS_NEW_INTENT.includes(status);
+}
+function newIntent(target, provenance, nowIso) {
+  return {
+    schemaVersion: 1,
+    target,
+    provenance,
+    status: "pending",
+    phase: null,
+    claimedBy: null,
+    leaseUntil: null,
+    attempt: 0,
+    breaker: "none",
+    result: null,
+    createdAt: nowIso,
+    updatedAt: nowIso
+  };
+}
 function applyRequestToEntity(r) {
   return { partitionKey: APPLY_REQUEST_PK, rowKey: APPLY_REQUEST_RK, value: JSON.stringify(r), updatedAt: r.updatedAt };
 }
@@ -20354,11 +20402,10 @@ function manifestSourceForVersionTag(channelUrl, version) {
   const tag = platformTag(version);
   const custom = channelUrl.trim();
   if (!custom || custom === CHANNEL_LATEST_URL) return { channel: true, version: tag };
-  if (custom.includes("/releases/latest/download/")) {
-    return { url: custom.replace("/releases/latest/download/", `/releases/download/${tag}/`) };
-  }
-  return { url: custom };
+  const swapped = custom.replace(POINTER_SEGMENT, `/releases/download/${tag}/`);
+  return { url: swapped };
 }
+var POINTER_SEGMENT = /\/releases\/(?:latest\/download|download\/[^/]+)\//;
 async function fetchManifest(source, deps = {}) {
   const readFile9 = deps.readFile ?? ((p) => fs23.readFileSync(p, "utf8"));
   const fetchImpl = deps.fetchImpl ?? fetch;
@@ -21630,25 +21677,25 @@ function mergeThreeWay(ours, base, theirs) {
     fs27.rmSync(dir, { recursive: true, force: true });
   }
 }
-var skip = (path48, skipReason) => ({ path: path48, kind: "skip", skipReason });
+var skip = (path47, skipReason) => ({ path: path47, kind: "skip", skipReason });
 function classifyCandidate(c) {
-  const { path: path48, base, ours, theirs } = c;
-  if (theirs === base) return { path: path48, kind: "noop" };
+  const { path: path47, base, ours, theirs } = c;
+  if (theirs === base) return { path: path47, kind: "noop" };
   if (base === null) {
-    if (theirs === null) return { path: path48, kind: "noop" };
-    if (ours === null) return { path: path48, kind: "add", content: theirs };
-    if (ours === theirs) return { path: path48, kind: "noop" };
-    return skip(path48, "you already have a file at this path");
+    if (theirs === null) return { path: path47, kind: "noop" };
+    if (ours === null) return { path: path47, kind: "add", content: theirs };
+    if (ours === theirs) return { path: path47, kind: "noop" };
+    return skip(path47, "you already have a file at this path");
   }
   if (ours === null) {
-    return theirs === null ? { path: path48, kind: "noop" } : skip(path48, "you removed this file; upstream changed it");
+    return theirs === null ? { path: path47, kind: "noop" } : skip(path47, "you removed this file; upstream changed it");
   }
   if (theirs === null) {
-    return ours === base ? { path: path48, kind: "delete" } : skip(path48, "you edited this file; upstream removed it");
+    return ours === base ? { path: path47, kind: "delete" } : skip(path47, "you edited this file; upstream removed it");
   }
-  if (ours === base) return { path: path48, kind: "update", content: theirs };
+  if (ours === base) return { path: path47, kind: "update", content: theirs };
   const m = mergeThreeWay(ours, base, theirs);
-  return m.ok ? { path: path48, kind: "update", content: m.merged } : skip(path48, "your edits conflict with the update");
+  return m.ok ? { path: path47, kind: "update", content: m.merged } : skip(path47, "your edits conflict with the update");
 }
 
 // src/lib/seed-pr-body.ts
@@ -21835,7 +21882,7 @@ function bindRepoApi(token, repo) {
     openPr: (head, base, title, body) => openPullRequestViaApp({ token, repo, base, head, title, body }),
     updatePr: (n, title, body) => updatePullRequestViaApp({ token, repo, number: n, title, body }),
     closePr: (n, comment) => closePullRequestViaApp({ token, repo, number: n, comment }),
-    readFileAtRef: (path48, ref) => readRepoFileViaApp({ token, repo, path: path48, ref })
+    readFileAtRef: (path47, ref) => readRepoFileViaApp({ token, repo, path: path47, ref })
   };
 }
 async function runSeedRefresh(args) {
@@ -22337,7 +22384,6 @@ function resolveHeadlessContextFromEnv(env) {
 
 // src/lib/apply-request-store.ts
 import { TableClient as TableClient4 } from "@azure/data-tables";
-var MAX_LEASE_TAKEOVERS = 2;
 async function openApplyTable(opts) {
   const { tableEndpoint } = await discoverStampStorage(opts);
   return new TableClient4(tableEndpoint, "Metadata", opts.credential);
@@ -22423,32 +22469,59 @@ function assertForwardTarget(manifest) {
 }
 
 // src/lib/platform-self-update.ts
-import * as fs30 from "fs";
-import * as path32 from "path";
 function toVTag2(v) {
   return v.startsWith("v") ? v : `v${v}`;
 }
-function readBakedReleaseVersion(repoRoot) {
-  if (!repoRoot) return null;
-  try {
-    const raw = fs30.readFileSync(path32.join(repoRoot, "installer", "version.json"), "utf8");
-    const v = JSON.parse(raw).version;
-    return typeof v === "string" && v.length > 0 ? v : null;
-  } catch {
-    return null;
-  }
-}
-function needsEngineUpdate(manifest, runningVersion, bakedRelease) {
+function needsEngineUpdate(manifest, runningVersion, runningImage) {
   if (runningVersion === "0.0.0-dev") return false;
-  if (bakedRelease != null && bakedRelease.length > 0 && bakedRelease !== manifest.components.installer.version) return true;
+  if (needsEngineImageHop(manifest, runningVersion, runningImage ?? null)) return true;
   const running = toVTag2(runningVersion);
   const min = toVTag2(manifest.components.cli.min);
   return compareSemver(running, min) < 0;
 }
+function needsPreClaimEngineUpdate(manifest, runningVersion, runningImage) {
+  return needsEngineImageHop(manifest, runningVersion, runningImage ?? null);
+}
+function targetEngineImage(manifest) {
+  const inst = manifest.components.installer;
+  return `${inst.ref}:${inst.tag}`;
+}
+function ownJobName(env = process.env) {
+  const name = (env.UPDATER_JOB_NAME ?? "").trim();
+  return name.length > 0 ? name : null;
+}
+async function readOwnJobImage(opts) {
+  const job = opts.jobName ?? ownJobName();
+  if (!job) return null;
+  const image = (await runAz([
+    "containerapp",
+    "job",
+    "show",
+    "-n",
+    job,
+    "-g",
+    opts.resourceGroup,
+    "--subscription",
+    opts.subscriptionId,
+    "--query",
+    "properties.template.containers[0].image",
+    "-o",
+    "tsv",
+    "--only-show-errors"
+  ])).trim();
+  if (!image || image === "None") {
+    throw new Error(`could not read the updater job's current image (job ${job}) \u2014 refusing to decide a self-update blind`);
+  }
+  return image;
+}
+function needsEngineImageHop(manifest, runningVersion, runningImage) {
+  if (runningVersion === "0.0.0-dev") return false;
+  if (runningImage === null || runningImage.trim().length === 0) return false;
+  return runningImage.trim() !== targetEngineImage(manifest);
+}
 async function updateOwnJobImage(opts) {
-  const inst = opts.manifest.components.installer;
-  const image = `${inst.ref}:${inst.tag}`;
-  const job = opts.jobName ?? process.env.UPDATER_JOB_NAME;
+  const image = targetEngineImage(opts.manifest);
+  const job = opts.jobName ?? ownJobName();
   if (!job) throw new Error("UPDATER_JOB_NAME unset \u2014 cannot self-update the updater job image");
   await runAz([
     "containerapp",
@@ -22618,13 +22691,9 @@ async function readBreaker(client) {
 
 // src/commands/platform/converge.ts
 init_errors();
-function canonicalVersion(v) {
-  const bare = v.replace(/^platform-/, "");
-  return bare.startsWith("v") ? bare : `v${bare}`;
-}
 function isForwardTarget(target, installed) {
   if (!installed) return true;
-  return compareSemver(canonicalVersion(target), canonicalVersion(installed)) >= 0;
+  return comparePlatformVersion(target, installed) >= 0;
 }
 async function failIfStillInFlight(client, now, error) {
   const cur = await readApplyRequest(client);
@@ -22655,6 +22724,28 @@ var PlatformConvergeCommand = class extends M8tCommand {
       subscriptionId: ctx.subscriptionId,
       resourceGroup: ctx.resourceGroup
     });
+    let runningImage = null;
+    const outstanding = await readApplyRequest(client);
+    if (outstanding && blocksNewIntent(outstanding.status)) {
+      runningImage = await readOwnJobImage({
+        subscriptionId: ctx.subscriptionId,
+        resourceGroup: ctx.resourceGroup
+      });
+      if (runningImage) {
+        const preManifest = await fetchManifest(targetManifestSource(ctx, outstanding.target));
+        if (needsPreClaimEngineUpdate(preManifest, CLI_VERSION, runningImage)) {
+          log(
+            `self-updating BEFORE claiming (running ${runningImage} \u2192 target ${targetEngineImage(preManifest)}); the next tick claims with the new engine.`
+          );
+          await updateOwnJobImage({
+            subscriptionId: ctx.subscriptionId,
+            resourceGroup: ctx.resourceGroup,
+            manifest: preManifest
+          });
+          return 0;
+        }
+      }
+    }
     const claimed = await claimApplyRequest(client, executionId, now(), 30 * 60 * 1e3);
     if (!claimed) {
       log("no pending apply-request \u2014 nothing to converge.");
@@ -22689,10 +22780,9 @@ var PlatformConvergeCommand = class extends M8tCommand {
       return 1;
     }
     const repoRoot = tryResolveRepoRoot();
-    const bakedRelease = readBakedReleaseVersion(repoRoot);
-    if (needsEngineUpdate(manifest, CLI_VERSION, bakedRelease)) {
+    if (needsEngineUpdate(manifest, CLI_VERSION, runningImage)) {
       log(
-        `self-updating the updater image (baked release ${bakedRelease ?? "(none)"} / engine ${CLI_VERSION} \u2192 target installer ${manifest.components.installer.version}, cli.min ${manifest.components.cli.min}).`
+        `self-updating the updater image (running ${runningImage ?? "(not the job)"} / engine ${CLI_VERSION} \u2192 target ${targetEngineImage(manifest)}, cli.min ${manifest.components.cli.min}).`
       );
       await updateOwnJobImage({
         subscriptionId: ctx.subscriptionId,
@@ -22854,12 +22944,270 @@ function targetManifestSource(ctx, target) {
   return manifestSourceForVersionTag(ctx.channelUrl, target);
 }
 
-// src/commands/platform/seed-stamp.ts
-import { readFileSync as readFileSync21 } from "fs";
+// src/commands/platform/clear-intent.ts
 import { Command as Command37, Option as Option34 } from "clipanion";
 import { DefaultAzureCredential as DefaultAzureCredential18, ManagedIdentityCredential as ManagedIdentityCredential2 } from "@azure/identity";
 init_errors();
 
+// src/lib/apply-intent-clear.ts
+var CLEARED_BY_OPERATOR = "cleared by an operator via `m8t platform clear-intent`";
+function decideClear(row, nowIso, force) {
+  if (!row) return { action: "none", reason: "there is no apply-request to clear." };
+  if (!isInFlight(row.status) && row.status !== "pending" && row.status !== "awaiting-engine-update") {
+    return { action: "none", reason: `the apply-request is already terminal (${row.status}) \u2014 a new intent can be written.` };
+  }
+  const leaseLive = isInFlight(row.status) && row.leaseUntil !== null && Date.parse(row.leaseUntil) > Date.parse(nowIso);
+  if (leaseLive && !force) {
+    return {
+      action: "refuse",
+      reason: `the apply-request is ${row.status} and its lease is still live until ${row.leaseUntil ?? "(unknown)"} \u2014 a converge may be running right now. Clearing it could start a second apply alongside the first. Wait for the lease to expire, or pass --force if you know the engine is gone.`
+    };
+  }
+  const held = leaseLive ? " (lease still live \u2014 forced)" : "";
+  return { action: "clear", reason: `clearing a ${row.status} apply-request for target ${row.target}${held}.` };
+}
+function clearedRow(row, nowIso) {
+  return {
+    ...row,
+    status: "failed",
+    result: {
+      appliedVersion: row.result?.appliedVersion ?? null,
+      error: `${CLEARED_BY_OPERATOR} (was ${row.status}${row.phase ? `, phase "${row.phase}"` : ""})`
+    },
+    updatedAt: nowIso
+  };
+}
+
+// src/commands/platform/clear-intent.ts
+var PlatformClearIntentCommand = class extends M8tCommand {
+  static paths = [["platform", "clear-intent"]];
+  static usage = Command37.Usage({
+    description: "Clear a stuck platform update request so a new one can be made.",
+    details: "An update request that never settles blocks every later request, and the routines that would normally rescue it all run inside the updater itself \u2014 which is no help when the updater is what is stuck. This clears it from outside. Refuses while an update may still be running, unless --force.",
+    examples: [
+      ["Clear a stuck request", "m8t platform clear-intent --resource-group rg-m8t --subscription <id>"],
+      ["Clear one whose lease is still live", "m8t platform clear-intent --resource-group rg-m8t --subscription <id> --force"]
+    ]
+  });
+  subscription = Option34.String("--subscription");
+  resourceGroup = Option34.String("--resource-group");
+  miClientId = Option34.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  force = Option34.Boolean("--force", false, {
+    description: "Clear even while the lease is live. Only when you know the engine that held it is gone."
+  });
+  output = Option34.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(this.output, this.context.stdout);
+    const need = (v, flag) => {
+      if (typeof v !== "string" || v.trim().length === 0) {
+        throw new LocalCliError({ code: "PLATFORM_CLEAR_INTENT_ARG_MISSING", message: `${flag} is required.` });
+      }
+      return v.trim();
+    };
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential2({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential18();
+    const client = await openApplyTable({
+      credential: credential2,
+      subscriptionId: need(this.subscription, "--subscription"),
+      resourceGroup: need(this.resourceGroup, "--resource-group")
+    });
+    const row = await readApplyRequest(client);
+    const decision = decideClear(row, (/* @__PURE__ */ new Date()).toISOString(), this.force);
+    if (decision.action === "refuse") {
+      throw new LocalCliError({
+        code: "PLATFORM_CLEAR_INTENT_REFUSED",
+        message: decision.reason,
+        hint: "Re-run with --force once you have confirmed no converge is running."
+      });
+    }
+    if (decision.action === "none" || !row) {
+      this.context.stdout.write(
+        mode === "json" ? renderJson({ cleared: false, reason: decision.reason }) + "\n" : `${decision.reason}
+`
+      );
+      return 0;
+    }
+    const next = clearedRow(row, (/* @__PURE__ */ new Date()).toISOString());
+    await client.updateEntity(applyRequestToEntity(next), "Merge");
+    const result2 = { cleared: true, previousStatus: row.status, target: row.target, reason: decision.reason };
+    this.context.stdout.write(
+      mode === "json" ? renderJson(result2) + "\n" : `cleared: ${row.status} \u2192 failed (target ${row.target}). A new update can now be requested.
+`
+    );
+    return 0;
+  }
+};
+
+// src/commands/platform/request-update.ts
+import { Command as Command38, Option as Option35 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential19, ManagedIdentityCredential as ManagedIdentityCredential3 } from "@azure/identity";
+init_errors();
+
+// src/lib/request-update-follow.ts
+var TERMINAL = {
+  success: true,
+  failed: false,
+  "rolled-back": false,
+  held: false
+};
+function isTerminal(status) {
+  return status in TERMINAL;
+}
+function classifyPolledRow(row, target) {
+  if (!row) return null;
+  if (row.target !== target) return { kind: "not-ours", otherTarget: row.target };
+  if (isTerminal(row.status)) return { kind: "settled", row };
+  return { kind: "in-progress", where: positionLabel(row.status, row.phase) };
+}
+function positionLabel(status, phase) {
+  return phase ? `${status} (${phase})` : status;
+}
+function outcomeExitCode(settled) {
+  if (!settled) return 1;
+  return TERMINAL[settled.status] ? 0 : 1;
+}
+function outcomeStatus(settled) {
+  return settled?.status ?? "timed-out";
+}
+
+// src/commands/platform/request-update.ts
+var PlatformRequestUpdateCommand = class extends M8tCommand {
+  static paths = [["platform", "request-update"]];
+  static usage = Command38.Usage({
+    description: "Ask this installation's updater to converge to a version, exactly as the in-app button does.",
+    details: "Writes the update request the updater job claims on its next tick. This is the ONLY privilege the requester holds \u2014 it does not deploy anything itself; the install's own updater fetches the release, applies it, health-gates it and rolls back on failure. With --wait, follows the request to a terminal state and exits non-zero if it did not succeed.",
+    examples: [
+      ["Request an update", "m8t platform request-update --version 0.7.2 --resource-group rg-m8t --subscription <id>"],
+      ["Request it and wait", "m8t platform request-update --version 0.7.2 --wait --resource-group rg-m8t --subscription <id>"]
+    ]
+  });
+  version = Option35.String("--version", { description: "The platform version to converge to." });
+  subscription = Option35.String("--subscription");
+  resourceGroup = Option35.String("--resource-group");
+  source = Option35.String("--source", "cd", { description: "Who is asking: cd | button | policy." });
+  identity = Option35.String("--identity", "", { description: "Recorded on the request, for the audit trail." });
+  miClientId = Option35.String("--mi-client-id");
+  wait = Option35.Boolean("--wait", false, { description: "Follow the request until it settles." });
+  /**
+   * Follow an EXISTING request without writing a new one.
+   *
+   * Lets a caller write the request in one step and wait in another, which is
+   * what makes the ordering provable: the row is a fact before anything is
+   * started against it, instead of a background write racing a sleep.
+   */
+  waitOnly = Option35.Boolean("--wait-only", false, { description: "Follow the current request without creating one." });
+  timeoutMinutes = Option35.String("--timeout-minutes", "45");
+  pollSeconds = Option35.String("--poll-seconds", "20");
+  output = Option35.String("--output");
+  async executeCommand() {
+    const mode = resolveOutputMode(this.output, this.context.stdout);
+    const need = (v, flag) => {
+      if (typeof v !== "string" || v.trim().length === 0) {
+        throw new LocalCliError({ code: "PLATFORM_REQUEST_UPDATE_ARG_MISSING", message: `${flag} is required.` });
+      }
+      return v.trim();
+    };
+    const target = need(this.version, "--version");
+    const SOURCES2 = ["cd", "button", "policy"];
+    if (!SOURCES2.includes(this.source)) {
+      throw new LocalCliError({ code: "PLATFORM_REQUEST_UPDATE_BAD_SOURCE", message: `--source must be cd, button or policy; got '${this.source}'.` });
+    }
+    const source = this.source;
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential3({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential19();
+    const client = await openApplyTable({
+      credential: credential2,
+      subscriptionId: need(this.subscription, "--subscription"),
+      resourceGroup: need(this.resourceGroup, "--resource-group")
+    });
+    const log = (m) => {
+      this.context.stderr.write(`${m}
+`);
+    };
+    if (!this.waitOnly) {
+      const existing = await readApplyRequest(client);
+      if (existing && blocksNewIntent(existing.status)) {
+        throw new LocalCliError({
+          code: "PLATFORM_REQUEST_UPDATE_IN_PROGRESS",
+          message: `an update request for ${existing.target} is already ${existing.status}.`,
+          hint: "Wait for it to settle, or clear it with `m8t platform clear-intent` if nothing is advancing it."
+        });
+      }
+      const now = (/* @__PURE__ */ new Date()).toISOString();
+      const intent = newIntent(target, { source, identity: this.identity || source, at: now }, now);
+      await client.upsertEntity(applyRequestToEntity(intent), "Replace");
+      log(`requested update to ${target} (source ${source}).`);
+    } else {
+      log(`following the existing request for ${target}.`);
+    }
+    if (!this.wait && !this.waitOnly) {
+      this.context.stdout.write(
+        mode === "json" ? renderJson({ requested: true, target, waited: false }) + "\n" : `requested update to ${target}.
+`
+      );
+      return 0;
+    }
+    const settled = await this.follow(client, target, log);
+    const result2 = {
+      requested: true,
+      target,
+      waited: true,
+      status: outcomeStatus(settled),
+      error: settled?.result?.error ?? null
+    };
+    this.context.stdout.write(
+      mode === "json" ? renderJson(result2) + "\n" : `${target}: ${result2.status}${result2.error ? ` \u2014 ${result2.error}` : ""}
+`
+    );
+    return outcomeExitCode(settled);
+  }
+  /**
+   * Follow the request until it settles.
+   *
+   * `awaiting-engine-update` is explicitly NOT a failure and not a stall: the
+   * updater parks a request there while it replaces its own image, so a converge
+   * legitimately spans two ticks. Treating that as stuck would fail a build for
+   * doing exactly what it is supposed to do.
+   */
+  async follow(client, target, log) {
+    const timeoutMs = Number(this.timeoutMinutes) * 60 * 1e3;
+    const pollMs = Number(this.pollSeconds) * 1e3;
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+      throw new LocalCliError({ code: "PLATFORM_REQUEST_UPDATE_BAD_TIMEOUT", message: `--timeout-minutes must be a positive number, got '${this.timeoutMinutes}'.` });
+    }
+    const deadline = Date.now() + timeoutMs;
+    let lastReported = "";
+    let consecutiveAbsent = 0;
+    while (Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, pollMs));
+      const verdict = classifyPolledRow(await readApplyRequest(client), target);
+      if (!verdict) {
+        consecutiveAbsent += 1;
+        if (consecutiveAbsent >= 3) {
+          throw new LocalCliError({
+            code: "PLATFORM_REQUEST_UPDATE_ROW_ABSENT",
+            message: `no update request found for ${target} after ${String(consecutiveAbsent)} polls.`,
+            hint: "Something removed the row after it was written. Check for a concurrent `clear-intent` or a competing requester."
+          });
+        }
+        continue;
+      }
+      consecutiveAbsent = 0;
+      if (verdict.kind === "settled") return verdict.row;
+      const line2 = verdict.kind === "not-ours" ? `  (ignoring a request for ${verdict.otherTarget} \u2014 not the one we made)` : `  ${verdict.where}`;
+      if (line2 !== lastReported) {
+        log(line2);
+        lastReported = line2;
+      }
+    }
+    return null;
+  }
+};
+
+// src/commands/platform/seed-stamp.ts
+import { readFileSync as readFileSync20 } from "fs";
+import { Command as Command39, Option as Option36 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential20, ManagedIdentityCredential as ManagedIdentityCredential4 } from "@azure/identity";
+init_errors();
+
 // src/lib/platform-stamp-seed.ts
 var IMAGE_COMPONENTS = ["gateway", "codingAgent", "azureExecutor"];
 var BARE_SEMVER = /^\d+\.\d+\.\d+$/;
@@ -22942,7 +23290,7 @@ function buildSeedStamp(d, cliVersion, nowIso) {
 
 // src/commands/platform/seed-stamp.ts
 async function seedStamp2(args) {
-  const readFileImpl = args.readFileImpl ?? ((p) => readFileSync21(p, "utf8"));
+  const readFileImpl = args.readFileImpl ?? ((p) => readFileSync20(p, "utf8"));
   const readStampImpl = args.readStampImpl ?? readStamp;
   const writeStampImpl = args.writeStampImpl ?? ((stamp2, o) => writeStamp({ ...o, stamp: stamp2 }));
   const discoverImpl = args.discoverImpl ?? discoverStampStorage;
@@ -22988,15 +23336,15 @@ async function seedStamp2(args) {
 }
 var PlatformSeedStampCommand = class extends M8tCommand {
   static paths = [["platform", "seed-stamp"]];
-  static usage = Command37.Usage({
+  static usage = Command39.Usage({
     description: "INTERNAL: write the initial installed-state stamp from a build-time install descriptor.",
     details: "Used by the cloud installer at the end of a from-zero install so the platform records which release it is running. Writes the stamp ONLY IF ABSENT \u2014 it never overwrites a stamp written by the converge engine, so a re-run or a container restart is harmless. Not a founder-facing command: to change what is installed, use 'm8t platform update'."
   });
-  descriptor = Option34.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
-  subscription = Option34.String("--subscription");
-  resourceGroup = Option34.String("--resource-group");
-  miClientId = Option34.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
-  output = Option34.String("--output");
+  descriptor = Option36.String("--descriptor", { description: "Path to install-descriptor.json (baked into the installer image)." });
+  subscription = Option36.String("--subscription");
+  resourceGroup = Option36.String("--resource-group");
+  miClientId = Option36.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
+  output = Option36.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -23009,7 +23357,7 @@ var PlatformSeedStampCommand = class extends M8tCommand {
       this.context.stderr.write(`${m}
 `);
     };
-    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential2({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential18();
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential4({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential20();
     const result2 = await seedStamp2({
       descriptorPath: need(this.descriptor, "--descriptor"),
       credential: credential2,
@@ -23027,105 +23375,9 @@ var PlatformSeedStampCommand = class extends M8tCommand {
   }
 };
 
-// src/commands/platform/stamp-build.ts
-import { Command as Command38, Option as Option35 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential19, ManagedIdentityCredential as ManagedIdentityCredential3 } from "@azure/identity";
-init_errors();
-
-// src/lib/platform-stamp-build.ts
-var BARE_SEMVER2 = /^\d+\.\d+\.\d+$/;
-function buildRunningBuildStamp(input) {
-  if (!BARE_SEMVER2.test(input.version)) {
-    throw new Error(
-      `platform version must be bare X.Y.Z, got "${input.version}" \u2014 a build tag cannot be represented as a version.`
-    );
-  }
-  return {
-    schemaVersion: 1,
-    platformVersion: platformTag(input.version),
-    previousPlatformVersion: input.previousPlatformVersion,
-    updatedAt: input.nowIso,
-    lastResult: "success",
-    cli: input.cliVersion,
-    origin: "cd",
-    components: {
-      gateway: { tag: input.gatewayTag, digest: input.gatewayDigest, state: "managed" },
-      codingAgent: { tag: "", digest: "", state: "external" },
-      azureExecutor: { tag: "", digest: "", state: "external" },
-      personas: input.personas,
-      infra: { treeSha: input.infraTreeSha },
-      ...input.brainSeeds ? { brainSeeds: input.brainSeeds } : {}
-    }
-  };
-}
-
-// src/commands/platform/stamp-build.ts
-var PlatformStampBuildCommand = class extends M8tCommand {
-  static paths = [["platform", "stamp-build"]];
-  static usage = Command38.Usage({
-    description: "Record the currently running build as this install's platform version.",
-    details: "For installs that are deployed continuously rather than from a published release. Unlike the install-time record, this overwrites on every run \u2014 the running build is the truth. Only components this writer deploys are reported; the rest are marked as managed elsewhere."
-  });
-  version = Option35.String("--version", { description: "The running build's own version, bare X.Y.Z." });
-  gatewayTag = Option35.String("--gateway-tag", { description: "The tag of the gateway image this build deployed." });
-  gatewayDigest = Option35.String("--gateway-digest", { description: "The digest of the gateway image this build deployed." });
-  subscription = Option35.String("--subscription");
-  resourceGroup = Option35.String("--resource-group");
-  miClientId = Option35.String("--mi-client-id", { description: "Authenticate as this user-assigned managed identity instead of the ambient credential." });
-  output = Option35.String("--output");
-  async executeCommand() {
-    const mode = resolveOutputMode(this.output, this.context.stdout);
-    const need = (v, flag) => {
-      if (typeof v !== "string" || v.trim().length === 0) {
-        throw new LocalCliError({ code: "PLATFORM_STAMP_BUILD_ARG_MISSING", message: `${flag} is required.` });
-      }
-      return v.trim();
-    };
-    const onProgress = (m) => {
-      this.context.stderr.write(`${m}
-`);
-    };
-    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential3({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential19();
-    const ctx = {
-      credential: credential2,
-      subscriptionId: need(this.subscription, "--subscription"),
-      resourceGroup: need(this.resourceGroup, "--resource-group")
-    };
-    const { accountName } = await discoverStampStorage(ctx);
-    const existing = await readStampOutcome(ctx);
-    if (existing.source === "unreadable") {
-      throw new LocalCliError({
-        code: "PLATFORM_STAMP_BUILD_PRIOR_UNREADABLE",
-        message: "Could not read the existing platform stamp; refusing to overwrite it blind.",
-        hint: "The running build is the truth about the CURRENT version, not about whether a previous one existed \u2014 retry once the prior record can be read."
-      });
-    }
-    const previousPlatformVersion = existing.source === "explicit" ? existing.stamp.platformVersion : null;
-    const priorComponents = existing.source === "explicit" ? existing.stamp.components : void 0;
-    const stamp = buildRunningBuildStamp({
-      version: need(this.version, "--version"),
-      gatewayTag: need(this.gatewayTag, "--gateway-tag"),
-      gatewayDigest: this.gatewayDigest ?? "",
-      previousPlatformVersion,
-      cliVersion: CLI_VERSION,
-      nowIso: (/* @__PURE__ */ new Date()).toISOString(),
-      personas: priorComponents?.personas ?? {},
-      infraTreeSha: priorComponents?.infra.treeSha ?? "",
-      ...priorComponents?.brainSeeds ? { brainSeeds: priorComponents.brainSeeds } : {}
-    });
-    await writeStamp({ ...ctx, stamp, onProgress });
-    const result2 = { platformVersion: stamp.platformVersion, previous: previousPlatformVersion, storageAccount: accountName };
-    this.context.stdout.write(
-      mode === "json" ? renderJson(result2) + "\n" : `platform stamp: ${result2.platformVersion} (previous ${result2.previous ?? "none"}, storage ${result2.storageAccount})
-`
-    );
-    return 0;
-  }
-};
-
 // src/commands/platform/policy.ts
-import { Command as Command39, Option as Option36 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential20, ManagedIdentityCredential as ManagedIdentityCredential4 } from "@azure/identity";
+import { Command as Command40, Option as Option37 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential21, ManagedIdentityCredential as ManagedIdentityCredential5 } from "@azure/identity";
 init_errors();
 
 // src/lib/platform-policy.ts
@@ -23180,16 +23432,16 @@ async function readPolicy(opts) {
 // src/commands/platform/policy.ts
 var PlatformPolicyCommand = class extends M8tCommand {
   static paths = [["platform", "policy"]];
-  static usage = Command39.Usage({
+  static usage = Command40.Usage({
     description: "Show or set how this install handles available platform updates.",
     details: "Modes: 'notify-only' shows updates but never applies them; 'auto-critical' (the default when unset) applies critical releases without asking; 'auto-all' applies every release. Use 'notify-only' where something else already controls what is deployed.",
     examples: [["Show the current mode", "m8t platform policy"], ["Never apply automatically", "m8t platform policy --set notify-only"]]
   });
-  set = Option36.String("--set", { description: "notify-only | auto-critical | auto-all" });
-  subscription = Option36.String("--subscription");
-  resourceGroup = Option36.String("--resource-group");
-  miClientId = Option36.String("--mi-client-id");
-  output = Option36.String("--output");
+  set = Option37.String("--set", { description: "notify-only | auto-critical | auto-all" });
+  subscription = Option37.String("--subscription");
+  resourceGroup = Option37.String("--resource-group");
+  miClientId = Option37.String("--mi-client-id");
+  output = Option37.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const need = (v, flag) => {
@@ -23202,7 +23454,7 @@ var PlatformPolicyCommand = class extends M8tCommand {
       this.context.stderr.write(`${m}
 `);
     };
-    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential4({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential20();
+    const credential2 = typeof this.miClientId === "string" && this.miClientId.trim().length > 0 ? new ManagedIdentityCredential5({ clientId: this.miClientId.trim() }) : new DefaultAzureCredential21();
     const ctx = {
       credential: credential2,
       subscriptionId: need(this.subscription, "--subscription"),
@@ -23235,7 +23487,7 @@ var PlatformPolicyCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-cost-report.ts
-import { Command as Command40, Option as Option37 } from "clipanion";
+import { Command as Command41, Option as Option38 } from "clipanion";
 
 // src/lib/wire-gateway-acs.ts
 init_rbac();
@@ -23275,18 +23527,18 @@ async function wireGatewayForAcs(args) {
 init_errors();
 var PlatformEnableCostReportCommand = class extends M8tCommand {
   static paths = [["platform", "enable-cost-report"]];
-  static usage = Command40.Usage({
+  static usage = Command41.Usage({
     description: "Wire the deployed gateway to send the bi-weekly cost report via ACS Email.",
     details: "Discovers the live gateway Container App, grants its managed identity Contributor at the ACS resource scope (authorising the ACS Email send), and sets M8T_ACS_ENDPOINT / M8T_ACS_SENDER / M8T_ENABLE_COST_REPORTER=1 on the gateway. Idempotent \u2014 safely re-runnable. ACS is created during the executor deploy; pass its endpoint, sender, and resource id (from that deploy or 'az communication list')."
   });
-  subscription = Option37.String("--subscription");
-  resourceGroup = Option37.String("--resource-group", {
+  subscription = Option38.String("--subscription");
+  resourceGroup = Option38.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  acsEndpoint = Option37.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
-  acsSender = Option37.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
-  acsResourceId = Option37.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
-  output = Option37.String("--output");
+  acsEndpoint = Option38.String("--acs-endpoint", { required: true, description: "ACS data-plane endpoint, e.g. https://acs-<name>.communication.azure.com/" });
+  acsSender = Option38.String("--acs-sender", { required: true, description: "Managed-domain sender address, e.g. DoNotReply@<guid>.azurecomm.net" });
+  acsResourceId = Option38.String("--acs-resource-id", { required: true, description: "ARM resource id of the acs-<name> Communication Service \u2014 the role-grant scope." });
+  output = Option38.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -23360,45 +23612,45 @@ var PlatformEnableCostReportCommand = class extends M8tCommand {
 };
 
 // src/commands/platform/enable-auto-update.ts
-import { Command as Command41, Option as Option38 } from "clipanion";
+import { Command as Command42, Option as Option39 } from "clipanion";
 import { confirm as confirm6 } from "@inquirer/prompts";
-import { DefaultAzureCredential as DefaultAzureCredential21 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
 init_errors();
 var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
   static paths = [["platform", "enable-auto-update"]];
-  static usage = Command41.Usage({
+  static usage = Command42.Usage({
     category: "Platform",
     description: "Retrofit the auto-updater (MI + cron job + role assignments) onto an existing install.",
     details: "For an install that predates the Platform Update Framework: recovers the deployment's resource-name suffix (from the stamped system/infra-params row, or by verified derivation from the live gateway), recovers the other bicep params from live state (WITHOUT changing the deployed gateway image), and re-runs deploy/main.bicep with provisionUpdater=true \u2014 which provisions the updater managed identity, the cron Container Apps Job, and every role assignment (Owner@RG + Foundry User@account + Storage Table + Storage Blob + AcrPull), all scoped to the resource group. On success, backfills system/infra-params so future converges never have to re-derive the suffix. Idempotent \u2014 safe to re-run."
   });
-  subscription = Option38.String("--subscription");
-  resourceGroup = Option38.String("--resource-group", {
+  subscription = Option39.String("--subscription");
+  resourceGroup = Option39.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
-  suffix = Option38.String("--suffix", {
+  suffix = Option39.String("--suffix", {
     description: "The existing deployment's resource-name suffix. Required when it cannot be recovered from system/infra-params or the live gateway."
   });
-  installerImage = Option38.String("--installer-image", {
+  installerImage = Option39.String("--installer-image", {
     required: true,
     description: "Updater CA-Job image ref (the converge engine at the current release). Required \u2014 an empty image would skip provisioning."
   });
-  updateCron = Option38.String("--update-cron", {
+  updateCron = Option39.String("--update-cron", {
     description: "Cron schedule for the updater job (bicep default applies when omitted)."
   });
-  channelUrl = Option38.String("--channel-url", {
+  channelUrl = Option39.String("--channel-url", {
     description: "Release-channel URL the updater job polls (bicep default applies when omitted)."
   });
-  location = Option38.String("--location", {
+  location = Option39.String("--location", {
     description: "Region for the updater identity + job. Defaults to the resource group's existing resources."
   });
-  foundryTracing = Option38.String("--foundry-tracing", {
+  foundryTracing = Option39.String("--foundry-tracing", {
     description: "project | account | skip. Pass the value the install was deployed with \u2014 omitting it lets the bicep default (project) switch tracing on."
   });
-  endpoint = Option38.String("--endpoint", {
+  endpoint = Option39.String("--endpoint", {
     description: "Foundry project endpoint URL. Disambiguates the project in a multi-project subscription."
   });
-  yes = Option38.Boolean("--yes", false);
-  output = Option38.String("--output");
+  yes = Option39.Boolean("--yes", false);
+  output = Option39.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -23417,7 +23669,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
       resourceGroup: this.resourceGroup
     });
     const { resourceGroup, name: gatewayName } = parseContainerAppResourceId(gw.containerAppResourceId);
-    const credential2 = new DefaultAzureCredential21();
+    const credential2 = new DefaultAzureCredential22();
     const account = await getAzAccount();
     const subscriptionId = this.subscription ?? account.subscriptionId;
     const explicitSuffix = typeof this.suffix === "string" && this.suffix.length > 0 ? this.suffix : void 0;
@@ -23535,7 +23787,7 @@ var PlatformEnableAutoUpdateCommand = class extends M8tCommand {
 };
 
 // src/commands/deploy.ts
-import { Command as Command42, Option as Option39 } from "clipanion";
+import { Command as Command43, Option as Option40 } from "clipanion";
 
 // src/lib/app-reg.ts
 init_esm();
@@ -23869,7 +24121,7 @@ async function patchRedirectUris(appObjectId, fqdn) {
 init_errors();
 
 // src/lib/whatif.ts
-import * as path33 from "path";
+import * as path32 from "path";
 
 // src/lib/identifier-patterns.ts
 var IDENTIFIER_PATTERNS = [
@@ -23925,7 +24177,7 @@ function deriveResourceType(resourceId) {
   return parts.join("/");
 }
 async function runWhatIf(opts) {
-  const bicepPath = path33.join(opts.repoRoot, "deploy", "main.bicep");
+  const bicepPath = path32.join(opts.repoRoot, "deploy", "main.bicep");
   const out = await runAz([
     "deployment",
     "group",
@@ -24023,9 +24275,9 @@ function flattenDelta(delta, prefix = "") {
   const out = [];
   for (const d of delta) {
     const segment = /^[0-9]+$/.test(d.path) ? `[${d.path}]` : prefix ? `.${d.path}` : d.path;
-    const path48 = prefix ? `${prefix}${segment}` : d.path;
-    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path48));
-    else out.push({ ...d, path: path48 });
+    const path47 = prefix ? `${prefix}${segment}` : d.path;
+    if (d.children && d.children.length > 0) out.push(...flattenDelta(d.children, path47));
+    else out.push({ ...d, path: path47 });
   }
   return out;
 }
@@ -24075,52 +24327,63 @@ function classifyWhatIf(changes) {
 var DEFAULT_IMAGE_REF = "ghcr.io/m8t-labs/m8t:latest";
 var DeployCommand = class extends M8tCommand {
   static paths = [["deploy"]];
-  static usage = Command42.Usage({
+  static usage = Command43.Usage({
     description: "Deploy (or update) the m8t gateway/webapp stack via Bicep.",
     details: "Ensures the Entra app reg (or pass --client-id to reuse an existing one \u2014 required if you can't create app regs), writes ~/.m8t/config.yaml, ensures the resource group, and runs deploy/main.bicep. The repo is located via ~/.m8t/repo-root."
   });
-  subscription = Option39.String("--subscription");
-  resourceGroup = Option39.String("--resource-group", "rg-m8t-stack");
-  location = Option39.String("--location", "eastus");
-  suffix = Option39.String("--suffix", "");
-  imageRef = Option39.String("--image-ref", DEFAULT_IMAGE_REF);
-  acrPullIdentity = Option39.String("--acrpull-identity");
-  acrResourceId = Option39.String("--acr-resource-id");
-  foundryEndpoint = Option39.String("--foundry-endpoint");
-  foundryResourceId = Option39.String("--foundry-resource-id");
-  foundryTracing = Option39.String("--foundry-tracing");
+  subscription = Option40.String("--subscription");
+  resourceGroup = Option40.String("--resource-group", "rg-m8t-stack");
+  location = Option40.String("--location", "eastus");
+  suffix = Option40.String("--suffix", "");
+  imageRef = Option40.String("--image-ref", DEFAULT_IMAGE_REF);
+  acrPullIdentity = Option40.String("--acrpull-identity");
+  acrResourceId = Option40.String("--acr-resource-id");
+  foundryEndpoint = Option40.String("--foundry-endpoint");
+  foundryResourceId = Option40.String("--foundry-resource-id");
+  foundryTracing = Option40.String("--foundry-tracing");
   // project | account | skip (bicep default: project)
-  clientId = Option39.String("--client-id");
-  whatIf = Option39.Boolean("--what-if", false);
+  clientId = Option40.String("--client-id");
+  whatIf = Option40.Boolean("--what-if", false);
   // Only meaningful with --what-if. Routes the comparison through the
   // value-free renderers (see ./lib/whatif-redact.js) instead of the default
   // before/after renderer. Defaults false so a local, interactive run keeps
   // showing values — that is the whole diagnostic point of --what-if.
   // Automation that forwards this output anywhere non-private (a CI log, an
   // issue) MUST pass --redact.
-  redact = Option39.Boolean("--redact", false);
-  output = Option39.String("--output");
+  redact = Option40.Boolean("--redact", false);
+  output = Option40.String("--output");
   // Subscription-scoped role assignments. Omitted ⇒ the template default (true).
   // Pass false when deploying as a principal scoped to the resource group only:
   // it cannot deploy at subscription scope, and those assignments persist
   // idempotently from the initial deployment anyway.
-  assignSubscriptionRoles = Option39.String("--assign-subscription-roles");
+  assignSubscriptionRoles = Option40.String("--assign-subscription-roles");
+  /**
+   * The installer image the updater Container-Apps Job runs.
+   *
+   * main.bicep only provisions the updater when an image is supplied
+   * (`provisionUpdaterEffective = provisionUpdater && !empty(installerImage)`),
+   * so a run that omits this describes a deployment WITHOUT an updater. For a
+   * real deploy that is merely a skip; for a `--what-if` comparison it is worse
+   * than that — the comparison proposes REMOVING an updater job that exists and
+   * should, and reports it as drift on every single run.
+   */
+  installerImage = Option40.String("--installer-image");
   // Referee — all optional, undefined by default ⇒ the bicep defaults
   // apply (dormant: gatewayCpu=0.25, gatewayMemory=0.5Gi, every referee/exam var
   // empty). Only pass these when explicitly enabling the referee exam stack.
-  gatewayCpu = Option39.String("--gateway-cpu");
-  gatewayMemory = Option39.String("--gateway-memory");
-  refereeEnabled = Option39.String("--referee-enabled");
-  refereeBrainRepos = Option39.String("--referee-brain-repos");
-  refereeFeedRepo = Option39.String("--referee-feed-repo");
-  refereeInstallationId = Option39.String("--referee-installation-id");
-  refereeWebhookHmacKvUri = Option39.String("--referee-webhook-hmac-kv-uri");
-  examKvUri = Option39.String("--exam-kv-uri");
-  examLaWorkspaceId = Option39.String("--exam-la-workspace-id");
-  brainEvalDeployment = Option39.String("--brain-eval-deployment");
-  brainAppLogin = Option39.String("--brain-app-login");
-  refereeCheckpointDir = Option39.String("--referee-checkpoint-dir");
-  examApiBase = Option39.String("--exam-api-base");
+  gatewayCpu = Option40.String("--gateway-cpu");
+  gatewayMemory = Option40.String("--gateway-memory");
+  refereeEnabled = Option40.String("--referee-enabled");
+  refereeBrainRepos = Option40.String("--referee-brain-repos");
+  refereeFeedRepo = Option40.String("--referee-feed-repo");
+  refereeInstallationId = Option40.String("--referee-installation-id");
+  refereeWebhookHmacKvUri = Option40.String("--referee-webhook-hmac-kv-uri");
+  examKvUri = Option40.String("--exam-kv-uri");
+  examLaWorkspaceId = Option40.String("--exam-la-workspace-id");
+  brainEvalDeployment = Option40.String("--brain-eval-deployment");
+  brainAppLogin = Option40.String("--brain-app-login");
+  refereeCheckpointDir = Option40.String("--referee-checkpoint-dir");
+  examApiBase = Option40.String("--exam-api-base");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24182,7 +24445,8 @@ var DeployCommand = class extends M8tCommand {
           brainAppLogin: this.brainAppLogin,
           refereeCheckpointDir: this.refereeCheckpointDir,
           examApiBase: this.examApiBase,
-          ...parseAssignSubscriptionRoles(this.assignSubscriptionRoles) === void 0 ? {} : { assignSubscriptionRoles: parseAssignSubscriptionRoles(this.assignSubscriptionRoles) }
+          ...parseAssignSubscriptionRoles(this.assignSubscriptionRoles) === void 0 ? {} : { assignSubscriptionRoles: parseAssignSubscriptionRoles(this.assignSubscriptionRoles) },
+          ...this.installerImage ? { installerImage: this.installerImage } : {}
         });
         const changes = await runWhatIf({ resourceGroup: this.resourceGroup, repoRoot: repoRoot2, params: params2 });
         const classified = classifyWhatIf(changes);
@@ -24250,7 +24514,8 @@ var DeployCommand = class extends M8tCommand {
       brainAppLogin: this.brainAppLogin,
       refereeCheckpointDir: this.refereeCheckpointDir,
       examApiBase: this.examApiBase,
-      ...parseAssignSubscriptionRoles(this.assignSubscriptionRoles) === void 0 ? {} : { assignSubscriptionRoles: parseAssignSubscriptionRoles(this.assignSubscriptionRoles) }
+      ...parseAssignSubscriptionRoles(this.assignSubscriptionRoles) === void 0 ? {} : { assignSubscriptionRoles: parseAssignSubscriptionRoles(this.assignSubscriptionRoles) },
+      ...this.installerImage ? { installerImage: this.installerImage } : {}
     });
     log("running Bicep deployment (~3-5 min)\u2026");
     const outputs = await runBicepDeployment({
@@ -24299,7 +24564,7 @@ var DeployCommand = class extends M8tCommand {
 
 // src/commands/eval/skill.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { Command as Command43, Option as Option40 } from "clipanion";
+import { Command as Command44, Option as Option41 } from "clipanion";
 init_errors();
 var DECISIONS = /* @__PURE__ */ new Set(["promote", "reject", "needs_review"]);
 var JUDGE_STATUSES = /* @__PURE__ */ new Set(["ok", "skipped", "unavailable"]);
@@ -24324,14 +24589,14 @@ function parseVerdict(stdout) {
 }
 var EvalSkillCommand = class extends M8tCommand {
   static paths = [["eval", "skill"]];
-  static usage = Command43.Usage({
+  static usage = Command44.Usage({
     description: "Vet one inbox skill candidate: promote / reject / needs_review. Shells out to the Python `brain-eval` core (override its path with $BRAIN_EVAL_BIN)."
   });
-  candidate = Option40.String();
-  skillsDir = Option40.String("--skills-dir");
-  noJudge = Option40.Boolean("--no-judge", false);
-  deployment = Option40.String("--deployment");
-  output = Option40.String("--output");
+  candidate = Option41.String();
+  skillsDir = Option41.String("--skills-dir");
+  noJudge = Option41.Boolean("--no-judge", false);
+  deployment = Option41.String("--deployment");
+  output = Option41.String("--output");
   executeCommand() {
     return Promise.resolve(this._runCommand());
   }
@@ -24388,9 +24653,9 @@ var EvalSkillCommand = class extends M8tCommand {
 
 // src/commands/eval/exam.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync22, existsSync as existsSync20, readdirSync as readdirSync3 } from "fs";
-import { join as join31 } from "path";
-import { Command as Command44, Option as Option41 } from "clipanion";
+import { writeFileSync as writeFileSync8, mkdirSync as mkdirSync6, readFileSync as readFileSync21, existsSync as existsSync20, readdirSync as readdirSync3 } from "fs";
+import { join as join30 } from "path";
+import { Command as Command45, Option as Option42 } from "clipanion";
 init_errors();
 init_esm();
 function parseArmToken(tok, opts) {
@@ -24571,9 +24836,9 @@ function resolveRefereeHome(refereeHomeOut, env) {
   return null;
 }
 function resolveTaskSetDir(base, worker, version) {
-  if (existsSync20(join31(base, version))) return version;
+  if (existsSync20(join30(base, version))) return version;
   const prefixed = `${worker}-${version}`;
-  if (existsSync20(join31(base, prefixed))) return prefixed;
+  if (existsSync20(join30(base, prefixed))) return prefixed;
   if (version === "latest" && existsSync20(base)) {
     const dirs = readdirSync3(base, { withFileTypes: true }).filter((d) => d.isDirectory() && d.name.startsWith(`${worker}-`)).map((d) => d.name).sort();
     if (dirs.length > 0) return dirs[dirs.length - 1];
@@ -24589,11 +24854,11 @@ function readSealedTaskIds(taskSetVersion, refereeHomeOut, env = process.env) {
       message: "cannot resolve the referee home to read the sealed-task manifest \u2014 set $REFEREE_HOME (mirroring the Python runner) so the feed can be redacted; refusing to emit a possibly-unredacted feed (Law-1)"
     });
   }
-  const versionDir = resolveTaskSetDir(join31(home, "tasksets", worker), worker, version);
-  const manifestPath = join31(home, "tasksets", worker, versionDir, "manifest.yaml");
+  const versionDir = resolveTaskSetDir(join30(home, "tasksets", worker), worker, version);
+  const manifestPath = join30(home, "tasksets", worker, versionDir, "manifest.yaml");
   let text;
   try {
-    text = readFileSync22(manifestPath, "utf-8");
+    text = readFileSync21(manifestPath, "utf-8");
   } catch (e) {
     throw new LocalCliError({
       code: "EXAM_REDACTION_UNSAFE",
@@ -24620,24 +24885,24 @@ function buildPlan(args) {
 }
 var EvalExamCommand = class extends M8tCommand {
   static paths = [["eval", "exam"]];
-  static usage = Command44.Usage({
+  static usage = Command45.Usage({
     description: "Run a brain exam: impact A/B + dream-delta. Resolves the plan, then shells out to the Python `brain-exam` orchestrator (override its path with $BRAIN_EXAM_BIN). Renders an ExamVerdict: three-valued verdict + power note + per-task flips."
   });
-  worker = Option41.String();
-  arms = Option41.String("--arms");
-  taskSet = Option41.String("--task-set");
-  examType = Option41.String("--exam-type");
-  skill = Option41.String("--skill");
-  reps = Option41.String("-n,--reps");
-  probes = Option41.String("--probes");
-  pool = Option41.String("--pool");
-  out = Option41.String("--out");
-  dryRun = Option41.Boolean("--dry-run", false);
-  keepArms = Option41.Boolean("--keep-arms", false);
-  allowStub = Option41.Boolean("--allow-stub", false);
-  deployment = Option41.String("--deployment");
-  output = Option41.String("--output");
-  observeWaitS = Option41.String("--observe-wait-s");
+  worker = Option42.String();
+  arms = Option42.String("--arms");
+  taskSet = Option42.String("--task-set");
+  examType = Option42.String("--exam-type");
+  skill = Option42.String("--skill");
+  reps = Option42.String("-n,--reps");
+  probes = Option42.String("--probes");
+  pool = Option42.String("--pool");
+  out = Option42.String("--out");
+  dryRun = Option42.Boolean("--dry-run", false);
+  keepArms = Option42.Boolean("--keep-arms", false);
+  allowStub = Option42.Boolean("--allow-stub", false);
+  deployment = Option42.String("--deployment");
+  output = Option42.String("--output");
+  observeWaitS = Option42.String("--observe-wait-s");
   async executeCommand() {
     await Promise.resolve();
     const worker = typeof this.worker === "string" ? this.worker : void 0;
@@ -24714,9 +24979,9 @@ var EvalExamCommand = class extends M8tCommand {
     if (out !== void 0) {
       const sealedTaskIds = taskSetVersion ? readSealedTaskIds(taskSetVersion, out) : /* @__PURE__ */ new Set();
       mkdirSync6(out, { recursive: true });
-      writeFileSync8(join31(out, "verdict.json"), JSON.stringify(verdict, null, 2));
+      writeFileSync8(join30(out, "verdict.json"), JSON.stringify(verdict, null, 2));
       const feed = redactForFeed(verdict, sealedTaskIds);
-      writeFileSync8(join31(out, "feed.json"), JSON.stringify(feed, null, 2));
+      writeFileSync8(join30(out, "feed.json"), JSON.stringify(feed, null, 2));
     }
     if (mode === "json") {
       this.context.stdout.write(renderJson(verdict) + "\n");
@@ -24752,10 +25017,10 @@ var EvalExamCommand = class extends M8tCommand {
 };
 
 // src/commands/version.ts
-import { Command as Command45, Option as Option42 } from "clipanion";
+import { Command as Command46, Option as Option43 } from "clipanion";
 var VersionCommand = class extends M8tCommand {
   static paths = [["version"], ["--version"], ["-v"]];
-  static usage = Command45.Usage({
+  static usage = Command46.Usage({
     description: "Print the CLI version.",
     details: "Prints the m8t CLI version. With --verbose, also prints Node version and platform.",
     examples: [
@@ -24763,8 +25028,8 @@ var VersionCommand = class extends M8tCommand {
       ["Print as JSON", "$0 version --output json"]
     ]
   });
-  output = Option42.String("--output", { description: "pretty | json | auto (default)" });
-  verbose = Option42.Boolean("--verbose", false);
+  output = Option43.String("--output", { description: "pretty | json | auto (default)" });
+  verbose = Option43.Boolean("--verbose", false);
   executeCommand() {
     const mode = resolveOutputMode(
       this.output ?? "auto",
@@ -24795,18 +25060,18 @@ var VersionCommand = class extends M8tCommand {
 };
 
 // src/commands/whoami.ts
-import { Command as Command46, Option as Option43 } from "clipanion";
+import { Command as Command47, Option as Option44 } from "clipanion";
 var WhoamiCommand = class extends M8tCommand {
   static paths = [["whoami"]];
-  static usage = Command46.Usage({
+  static usage = Command47.Usage({
     description: "Show your identity + the gateway you'll talk to. Probes the backend."
   });
-  output = Option43.String("--output");
-  verbose = Option43.Boolean("--verbose", false);
-  subscription = Option43.String("--subscription", {
+  output = Option44.String("--output");
+  verbose = Option44.Boolean("--verbose", false);
+  subscription = Option44.String("--subscription", {
     description: "Azure subscription ID to discover gateway in (defaults to active az subscription)."
   });
-  resourceGroup = Option43.String("--resource-group", {
+  resourceGroup = Option44.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -24871,7 +25136,7 @@ var WhoamiCommand = class extends M8tCommand {
 };
 
 // src/commands/status.ts
-import { Command as Command47, Option as Option44 } from "clipanion";
+import { Command as Command48, Option as Option45 } from "clipanion";
 
 // src/lib/azd.ts
 init_errors();
@@ -24936,10 +25201,10 @@ async function resolveLocalContext() {
 // src/commands/status.ts
 var StatusCommand = class extends M8tCommand {
   static paths = [["status"]];
-  static usage = Command47.Usage({
+  static usage = Command48.Usage({
     description: "Show the local m8t context: identity, config.yaml, gateway cache, azd mode."
   });
-  output = Option44.String("--output");
+  output = Option45.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -24977,11 +25242,11 @@ var StatusCommand = class extends M8tCommand {
 };
 
 // src/commands/doctor.ts
-import { Command as Command48, Option as Option45 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential22 } from "@azure/identity";
-import * as fs31 from "fs";
+import { Command as Command49, Option as Option46 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
+import * as fs30 from "fs";
 import * as os12 from "os";
-import * as path34 from "path";
+import * as path33 from "path";
 
 // src/lib/doctor-checks.ts
 function checkAzSignedIn(az) {
@@ -25460,40 +25725,40 @@ async function resolveAccountLocation(accountId) {
   }
 }
 function probeRepoRoot() {
-  const marker = path34.join(os12.homedir(), ".m8t", "repo-root");
-  if (!fs31.existsSync(marker)) {
+  const marker = path33.join(os12.homedir(), ".m8t", "repo-root");
+  if (!fs30.existsSync(marker)) {
     return { markerExists: false, path: null, isDir: false, isGitCheckout: false };
   }
   let repoPath;
   try {
-    repoPath = fs31.readFileSync(marker, "utf8").trim();
+    repoPath = fs30.readFileSync(marker, "utf8").trim();
   } catch {
     return { markerExists: true, path: null, isDir: false, isGitCheckout: false };
   }
   if (!repoPath) return { markerExists: true, path: null, isDir: false, isGitCheckout: false };
   let isDir = false;
   try {
-    isDir = fs31.statSync(repoPath).isDirectory();
+    isDir = fs30.statSync(repoPath).isDirectory();
   } catch {
     isDir = false;
   }
-  const isGitCheckout = isDir && fs31.existsSync(path34.join(repoPath, ".git"));
+  const isGitCheckout = isDir && fs30.existsSync(path33.join(repoPath, ".git"));
   return { markerExists: true, path: repoPath, isDir, isGitCheckout };
 }
 function probeLegacyStateDir() {
   return {
-    legacyExists: fs31.existsSync(path34.join(os12.homedir(), ".m8t-stack")),
-    currentExists: fs31.existsSync(path34.join(os12.homedir(), ".m8t"))
+    legacyExists: fs30.existsSync(path33.join(os12.homedir(), ".m8t-stack")),
+    currentExists: fs30.existsSync(path33.join(os12.homedir(), ".m8t"))
   };
 }
 var DoctorCommand = class extends M8tCommand {
   static paths = [["doctor"]];
-  static usage = Command48.Usage({
+  static usage = Command49.Usage({
     description: "Diagnose the local m8t setup: az login, config.yaml, gateway, Foundry data-plane."
   });
-  output = Option45.String("--output");
-  agent = Option45.String("--agent");
-  resourceGroup = Option45.String("--resource-group", {
+  output = Option46.String("--output");
+  agent = Option46.String("--agent");
+  resourceGroup = Option46.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -25566,7 +25831,7 @@ var DoctorCommand = class extends M8tCommand {
       let kvStatus = 0;
       if (kv) {
         try {
-          const token = await new DefaultAzureCredential22().getToken("https://vault.azure.net/.default");
+          const token = await new DefaultAzureCredential23().getToken("https://vault.azure.net/.default");
           const res = await fetch(`${kv.uri.replace(/\/$/, "")}/secrets?api-version=7.4&maxresults=1`, {
             headers: { Authorization: `Bearer ${token.token}` }
           });
@@ -25586,7 +25851,7 @@ var DoctorCommand = class extends M8tCommand {
       if (typeof this.agent === "string" && this.agent) {
         checking(`delivery grant for ${this.agent}`);
         try {
-          const credential2 = new DefaultAzureCredential22();
+          const credential2 = new DefaultAzureCredential23();
           const cur = await getAgentVersion({
             credential: credential2,
             projectEndpoint: foundry.projectEndpoint,
@@ -25629,11 +25894,11 @@ var DoctorCommand = class extends M8tCommand {
 };
 
 // src/commands/prereqs.ts
-import { Command as Command49, Option as Option46 } from "clipanion";
+import { Command as Command50, Option as Option47 } from "clipanion";
 init_errors();
 
 // src/lib/prereq-deps.ts
-import { DefaultAzureCredential as DefaultAzureCredential23 } from "@azure/identity";
+import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
 
 // src/lib/bootstrap-preflight.ts
 var ADMIN_DIRECTORY_ROLES = ["Global Administrator", "Application Administrator", "Cloud Application Administrator"];
@@ -25745,7 +26010,7 @@ function buildPrereqDeps(opts = {}) {
     probeRedirectUri,
     fixFoundryAccess,
     fixKeyVaultAccess,
-    credential: () => credentialSingleton2 ??= new DefaultAzureCredential23()
+    credential: () => credentialSingleton2 ??= new DefaultAzureCredential24()
   };
 }
 
@@ -26335,7 +26600,7 @@ function renderVerdict(v) {
 }
 var PrereqsCommand = class extends M8tCommand {
   static paths = [["prereqs"]];
-  static usage = Command49.Usage({
+  static usage = Command50.Usage({
     description: "Check (and optionally fix) everything m8t needs \u2014 to install, or for you to use it.",
     details: "Runs one of two phases. With no platform discoverable it checks INSTALL prerequisites: your Azure sign-in, subscription and directory rights, resource-provider registrations, soft-deleted Cognitive Services accounts (they hold their model quota until purged), and model quota. With a platform live it checks USAGE prerequisites for the signed-in account: the sign-in redirect URI, Foundry data-plane access, and Key Vault secrets access. Pass --fix to repair what is repairable, and --fix --for <upn> to set a teammate up (usage phase only). Read-only without --fix.",
     examples: [
@@ -26346,15 +26611,15 @@ var PrereqsCommand = class extends M8tCommand {
       ["Set a teammate up (needs role-assignment rights)", "$0 prereqs --fix --for alice@contoso.com"]
     ]
   });
-  fix = Option46.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
-  for_ = Option46.String("--for", { description: "UPN or object id of another person. Usage phase only." });
-  phase = Option46.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
-  region = Option46.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
-  model = Option46.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
-  clientId = Option46.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
-  subscription = Option46.String("--subscription");
-  resourceGroup = Option46.String("--resource-group");
-  output = Option46.String("--output");
+  fix = Option47.Boolean("--fix", false, { description: "Repair what is repairable. Without it the command only reports." });
+  for_ = Option47.String("--for", { description: "UPN or object id of another person. Usage phase only." });
+  phase = Option47.String("--phase", { description: "Force 'install' or 'usage' instead of auto-detecting." });
+  region = Option47.String("--region", { description: "Target region. Enables the install-phase quota check, and judges soft-deleted accounts against the region you will install into (without it, they only warn)." });
+  model = Option47.String("--model", { description: `Model whose quota the install needs (default ${INSTALL_REASONING_MODEL}).` });
+  clientId = Option47.String("--client-id", { description: "A ready app registration, in place of directory-admin rights." });
+  subscription = Option47.String("--subscription");
+  resourceGroup = Option47.String("--resource-group");
+  output = Option47.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const json = mode === "json";
@@ -26410,18 +26675,18 @@ var PrereqsCommand = class extends M8tCommand {
 };
 
 // src/commands/switch.ts
-import { Command as Command50, Option as Option47 } from "clipanion";
+import { Command as Command51, Option as Option48 } from "clipanion";
 
 // src/lib/profiles.ts
-import * as fs32 from "fs/promises";
-import * as path35 from "path";
+import * as fs31 from "fs/promises";
+import * as path34 from "path";
 import { parse as parseYaml12, stringify as stringifyYaml4 } from "yaml";
 function profilesDir() {
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
-  return path35.join(home, ".m8t", "profiles");
+  return path34.join(home, ".m8t", "profiles");
 }
 function getProfilePath(name) {
-  return path35.join(profilesDir(), `${path35.basename(name)}.yaml`);
+  return path34.join(profilesDir(), `${path34.basename(name)}.yaml`);
 }
 function slugifyTenant(domainOrId) {
   const base = domainOrId.split(".")[0].toLowerCase();
@@ -26430,7 +26695,7 @@ function slugifyTenant(domainOrId) {
 }
 async function listProfiles() {
   try {
-    const entries = await fs32.readdir(profilesDir());
+    const entries = await fs31.readdir(profilesDir());
     return entries.filter((e) => e.endsWith(".yaml")).map((e) => e.replace(/\.yaml$/, "")).sort();
   } catch (e) {
     if (e.code === "ENOENT") return [];
@@ -26439,7 +26704,7 @@ async function listProfiles() {
 }
 async function readProfile(name) {
   try {
-    const raw = await fs32.readFile(getProfilePath(name), "utf8");
+    const raw = await fs31.readFile(getProfilePath(name), "utf8");
     const parsed = parseYaml12(raw);
     if (!parsed || typeof parsed !== "object") return null;
     return parsed;
@@ -26450,14 +26715,14 @@ async function readProfile(name) {
 }
 async function exists(p) {
   try {
-    await fs32.stat(p);
+    await fs31.stat(p);
     return true;
   } catch {
     return false;
   }
 }
 async function saveProfile(p) {
-  await fs32.mkdir(profilesDir(), { recursive: true });
+  await fs31.mkdir(profilesDir(), { recursive: true });
   let name = p.name;
   let n = 2;
   while (await exists(getProfilePath(name))) {
@@ -26466,8 +26731,8 @@ async function saveProfile(p) {
   }
   const target = getProfilePath(name);
   const tmp = `${target}.tmp`;
-  await fs32.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
-  await fs32.rename(tmp, target);
+  await fs31.writeFile(tmp, stringifyYaml4({ ...p, name }, { indent: 2 }), "utf8");
+  await fs31.rename(tmp, target);
   return name;
 }
 
@@ -26550,14 +26815,14 @@ async function profileSwitch(name, asName) {
 init_errors();
 var SwitchCommand = class extends M8tCommand {
   static paths = [["switch"]];
-  static usage = Command50.Usage({
+  static usage = Command51.Usage({
     description: "Re-point local config at another deployment: --subscription <id|name> (discovery) or <profile>."
   });
-  profile = Option47.String({ required: false });
-  subscription = Option47.String("--subscription");
-  list = Option47.Boolean("--list", false);
-  as = Option47.String("--as");
-  output = Option47.String("--output");
+  profile = Option48.String({ required: false });
+  subscription = Option48.String("--subscription");
+  list = Option48.Boolean("--list", false);
+  as = Option48.String("--as");
+  output = Option48.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -26614,7 +26879,7 @@ var SwitchCommand = class extends M8tCommand {
 
 // src/commands/open.ts
 import { spawn as spawn5 } from "child_process";
-import { Command as Command51, Option as Option48 } from "clipanion";
+import { Command as Command52, Option as Option49 } from "clipanion";
 
 // src/lib/open-targets.ts
 init_errors();
@@ -26660,14 +26925,14 @@ function openUrl(url) {
 }
 var OpenCommand = class extends M8tCommand {
   static paths = [["open"]];
-  static usage = Command51.Usage({
+  static usage = Command52.Usage({
     description: "Open the deployed webapp (default), the Foundry portal, or the resource group.",
     details: "Targets: webapp (deployed app, default) | foundry (ai.azure.com) | portal (resource group in the Azure portal). Pass --print to emit the URL instead of launching a browser (also the default when stdout isn't a TTY)."
   });
-  target = Option48.String({ required: false });
-  print = Option48.Boolean("--print", false);
-  output = Option48.String("--output");
-  resourceGroup = Option48.String("--resource-group", {
+  target = Option49.String({ required: false });
+  print = Option49.Boolean("--print", false);
+  output = Option49.String("--output");
+  resourceGroup = Option49.String("--resource-group", {
     description: "m8t resource group to disambiguate the gateway (multi-deployment subscriptions)."
   });
   async executeCommand() {
@@ -26711,7 +26976,7 @@ var OpenCommand = class extends M8tCommand {
 };
 
 // src/commands/dream/run.ts
-import { Command as Command52, Option as Option49 } from "clipanion";
+import { Command as Command53, Option as Option50 } from "clipanion";
 import { AzureCliCredential } from "@azure/identity";
 import { TableClient as TableClient7 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient3 } from "@azure/ai-projects";
@@ -27756,7 +28021,7 @@ function buildAdvancePlan(worker, cursor, physicalPks, consumedRowsByPk, failedT
 // ../../packages/brain/engine/dist/esm/dream/writer.js
 var API2 = "https://api.github.com";
 var WRITER_ALLOWED_PREFIX = /^(memory|inbox|quarantine|artifacts)\//;
-var isAllowedWritePath = (path48, allowedPrefix) => allowedPrefix.test(path48) && !path48.split("/").includes("..");
+var isAllowedWritePath = (path47, allowedPrefix) => allowedPrefix.test(path47) && !path47.split("/").includes("..");
 var unquote = (s) => s.trim().replace(/^["']|["']$/g, "");
 function parseFrontmatter(content) {
   const m = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content);
@@ -27799,8 +28064,8 @@ function makeGitDataWriter(args) {
   if (args.allowedPathPrefix && !args.allowedPathPrefix.source.startsWith("^")) {
     throw new Error(`makeGitDataWriter: allowedPathPrefix must be anchored with "^" (got /${args.allowedPathPrefix.source}/) \u2014 an unanchored regex would widen the B1 write-path allowlist`);
   }
-  async function gh(token, method, path48, body) {
-    const res = await doFetch(`${API2}/repos/${repoPath}${path48}`, {
+  async function gh(token, method, path47, body) {
+    const res = await doFetch(`${API2}/repos/${repoPath}${path47}`, {
       method,
       headers: {
         Authorization: `Bearer ${token}`,
@@ -27813,8 +28078,8 @@ function makeGitDataWriter(args) {
     const text = await res.text();
     return { status: res.status, ok: res.ok, json: text ? JSON.parse(text) : {} };
   }
-  async function readFileWith(token, path48) {
-    const encodedPath = path48.split("/").map(encodeURIComponent).join("/");
+  async function readFileWith(token, path47) {
+    const encodedPath = path47.split("/").map(encodeURIComponent).join("/");
     const r = await gh(token, "GET", `/contents/${encodedPath}?ref=${args.branch}`);
     if (r.status === 404)
       return null;
@@ -27830,9 +28095,9 @@ function makeGitDataWriter(args) {
         throw new Error(`fetchTip: HTTP ${String(r.status)}`);
       return r.json.object.sha;
     },
-    async readFile(path48) {
+    async readFile(path47) {
       const token = await args.mintToken();
-      return readFileWith(token, path48);
+      return readFileWith(token, path47);
     },
     async listMemory() {
       const token = await args.mintToken();
@@ -27841,9 +28106,9 @@ function makeGitDataWriter(args) {
         return [];
       const paths = r.json.tree.filter((e) => e.type === "blob" && e.path.startsWith("memory/") && e.path.endsWith(".md")).map((e) => e.path);
       const out = [];
-      for (const path48 of paths) {
-        const content = await readFileWith(token, path48);
-        out.push({ path: path48, frontmatter: content ? parseFrontmatter(content) : {} });
+      for (const path47 of paths) {
+        const content = await readFileWith(token, path47);
+        out.push({ path: path47, frontmatter: content ? parseFrontmatter(content) : {} });
       }
       return out;
     },
@@ -28282,7 +28547,7 @@ async function loadMemoryContext(brain) {
   return {
     files,
     indexEntries,
-    originOf: (path48) => originByPath.get(path48) ?? "worker"
+    originOf: (path47) => originByPath.get(path47) ?? "worker"
   };
 }
 
@@ -28303,14 +28568,14 @@ function checkEvidenceMembership(delta, harvested) {
 }
 var BatchAbort = class extends Error {
   path;
-  constructor(path48, message) {
+  constructor(path47, message) {
     super(message);
-    this.path = path48;
+    this.path = path47;
     this.name = "BatchAbort";
   }
 };
-var isIndexFile = (path48) => /(^|\/)[^/]*_index\.md$/.test(path48);
-var isMemoryIndex = (path48) => path48 === "memory/MEMORY.md";
+var isIndexFile = (path47) => /(^|\/)[^/]*_index\.md$/.test(path47);
+var isMemoryIndex = (path47) => path47 === "memory/MEMORY.md";
 function targetPath(delta) {
   switch (delta.verb) {
     case "new":
@@ -28327,29 +28592,29 @@ function targetPath(delta) {
 }
 async function checkOriginTier(delta, lookup) {
   const evidence = evidenceOf(delta) ?? [];
-  const path48 = targetPath(delta);
-  if (path48 === null)
+  const path47 = targetPath(delta);
+  if (path47 === null)
     return { ok: true };
-  if (isIndexFile(path48) && !isMemoryIndex(path48)) {
-    return { ok: false, flagged: { kind: "flagged", path: path48, tension: `refused: ${path48} is an index file (only memory/MEMORY.md is editable)`, evidence } };
+  if (isIndexFile(path47) && !isMemoryIndex(path47)) {
+    return { ok: false, flagged: { kind: "flagged", path: path47, tension: `refused: ${path47} is an index file (only memory/MEMORY.md is editable)`, evidence } };
   }
-  const target = await lookup(path48);
-  const isStructural = path48.startsWith("references/");
+  const target = await lookup(path47);
+  const isStructural = path47.startsWith("references/");
   const origin = target?.frontmatter.origin ?? (isStructural ? "operator" : "worker");
   const editable = origin === "worker" || origin === "dream";
   if (editable)
     return { ok: true };
   const removesOperatorTarget = delta.verb === "retract" || delta.verb === "supersede" && delta.oldPath !== delta.newPath;
   if (removesOperatorTarget) {
-    throw new BatchAbort(path48, `supersede/retract OLD target ${path48} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
+    throw new BatchAbort(path47, `supersede/retract OLD target ${path47} is origin: ${origin} \u2014 aborting batch (never half-apply)`);
   }
-  return { ok: false, flagged: { kind: "flagged", path: path48, tension: `operator-origin (${origin}); flag-only`, evidence } };
+  return { ok: false, flagged: { kind: "flagged", path: path47, tension: `operator-origin (${origin}); flag-only`, evidence } };
 }
 var ALLOWED_MEMORY = /^memory\/.+\.md$/;
 var ALLOWED_INBOX = /^inbox\//;
 var ALLOWED_QUARANTINE = /^quarantine\//;
 var ALLOWED_FLAG = /^memory\//;
-var hasTraversal = (path48) => path48.split("/").includes("..");
+var hasTraversal = (path47) => path47.split("/").includes("..");
 function checkPathAllowed(delta) {
   const evidence = evidenceOf(delta) ?? [];
   const reject = (detail) => ({ ok: false, rejected: { kind: "rejected", detail, evidence } });
@@ -28456,7 +28721,7 @@ ${inject}
 ---
 ` + body.slice(m[0].length);
 }
-var indexLine = (path48, title, date, tags) => `- \`${path48}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
+var indexLine = (path47, title, date, tags) => `- \`${path47}\` \u2014 **${title}**: ${title}. (${date} \xB7 ${tags.join(", ")})`;
 function splitIndex(index) {
   const all = index.split("\n");
   const firstLineIdx = all.findIndex((l) => l.startsWith("- `memory/"));
@@ -28629,16 +28894,16 @@ function defaultDreamSeams(opts = {}) {
       const mem = await memory(deps.brain);
       const harvested = harvestedIds(input);
       const ctx = { readFile: (p) => deps.brain.readFile(p), at: deps.clock() };
-      const lookup = (path48) => Promise.resolve(mem.files.find((f) => f.path === path48) ?? null);
+      const lookup = (path47) => Promise.resolve(mem.files.find((f) => f.path === path47) ?? null);
       const digest = [...pendingRejected];
       let changes = [];
       let indexEdit;
       try {
         for (const raw of deltas) {
           const delta = forcePolicyQuarantine(raw);
-          const path48 = checkPathAllowed(delta);
-          if (!path48.ok) {
-            digest.push(path48.rejected);
+          const path47 = checkPathAllowed(delta);
+          if (!path47.ok) {
+            digest.push(path47.rejected);
             continue;
           }
           const ev = checkEvidenceMembership(delta, harvested);
@@ -29005,28 +29270,28 @@ function redactTranscripts(input) {
 }
 var DreamRunCommand = class extends M8tCommand {
   static paths = [["dream", "run"]];
-  static usage = Command52.Usage({
+  static usage = Command53.Usage({
     description: "Dry-run the brain consumption pipeline for one worker (no model call, no writes). Pass --live to actually run it.",
     details: "Builds AzureCliCredential + resolves the Foundry project, ledger table, and Log Analytics workspace, runs the consumption pipeline, and prints the skip-ledger, the partition invariant, and harvest stats. Transcripts are metadata-only unless --show-transcripts is passed.\n\nThe bare command is READ-ONLY. --live takes the other branch: a real model call and a commit to the worker's brain repo through a minted GitHub App token."
   });
-  worker = Option49.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
+  worker = Option50.String("--worker", { description: "Worker (canonical name) to harvest. Required." });
   // Opting IN to the side effects, rather than opting out of them. This command's
   // own help has always described a dry run, but the bare invocation used to take
   // the live branch — a real model call and a commit to the brain repo — so anyone
   // acting on `--help` got the opposite of what they read.
-  live = Option49.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
-  dryRun = Option49.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
-  since = Option49.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
-  reset = Option49.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
-  showTranscripts = Option49.Boolean("--show-transcripts", false, {
+  live = Option50.Boolean("--live", false, { description: "Actually run it: model call + commit to the brain repo." });
+  dryRun = Option50.Boolean("--dry-run", false, { description: "Read-only harvest. This is the default; the flag is accepted for compatibility." });
+  since = Option50.String("--since", { description: "ISO-8601 start override (rejected if malformed or future)." });
+  reset = Option50.Boolean("--reset", false, { description: "Ignore the stored cursor; read from the beginning." });
+  showTranscripts = Option50.Boolean("--show-transcripts", false, {
     description: "Print transcript bodies (default: metadata only)."
   });
-  subscription = Option49.String("--subscription");
-  endpoint = Option49.String("--endpoint");
-  storageAccount = Option49.String("--storage-account", {
+  subscription = Option50.String("--subscription");
+  endpoint = Option50.String("--endpoint");
+  storageAccount = Option50.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
-  output = Option49.String("--output");
+  output = Option50.String("--output");
   // Resolution seam — overridden by tests; built lazily at runtime otherwise.
   deps;
   async executeCommand() {
@@ -29377,7 +29642,7 @@ function defaultDeps(overrides) {
 
 // src/commands/conversations/sweep.ts
 import { createHash as createHash4 } from "crypto";
-import { Command as Command53, Option as Option50 } from "clipanion";
+import { Command as Command54, Option as Option51 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential2 } from "@azure/identity";
 import { TableClient as TableClient8 } from "@azure/data-tables";
 import { AIProjectClient as AIProjectClient4 } from "@azure/ai-projects";
@@ -29503,7 +29768,7 @@ function defaultDeps2() {
 }
 var ConversationsSweepCommand = class extends M8tCommand {
   static paths = [["conversations", "sweep"]];
-  static usage = Command53.Usage({
+  static usage = Command54.Usage({
     category: "Conversations",
     description: "Delete expired public-visitor conversations (dry run by default)",
     details: `
@@ -29519,22 +29784,22 @@ var ConversationsSweepCommand = class extends M8tCommand {
       ["Delete, capped at 50", "m8t conversations sweep --delete --max 50"]
     ]
   });
-  doDelete = Option50.Boolean("--delete", false, {
+  doDelete = Option51.Boolean("--delete", false, {
     description: "Perform deletions (without this flag the command only reports)"
   });
-  principal = Option50.String("--principal", {
+  principal = Option51.String("--principal", {
     description: "Service-principal oid whose end-user keys are known-ephemeral (required with --delete; a dry run without it reports candidates grouped by principal)"
   });
-  max = Option50.String("--max", "200", { description: "Maximum deletions per run" });
-  graceDays = Option50.String("--grace-days", "14", {
+  max = Option51.String("--max", "200", { description: "Maximum deletions per run" });
+  graceDays = Option51.String("--grace-days", "14", {
     description: "Days past the 30-day key life before a conversation is eligible"
   });
-  lookbackDays = Option50.String("--lookback-days", "180", {
+  lookbackDays = Option51.String("--lookback-days", "180", {
     description: "How far back to scan ledger activity for candidates"
   });
-  subscription = Option50.String("--subscription", { description: "Azure subscription id override" });
-  endpoint = Option50.String("--endpoint", { description: "Foundry project endpoint override" });
-  storageAccount = Option50.String("--storage-account", {
+  subscription = Option51.String("--subscription", { description: "Azure subscription id override" });
+  endpoint = Option51.String("--endpoint", { description: "Foundry project endpoint override" });
+  storageAccount = Option51.String("--storage-account", {
     description: "Ledger storage account name (skips tag-based discovery)"
   });
   deps = defaultDeps2();
@@ -29662,7 +29927,7 @@ var ConversationsSweepCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/create.ts
-import { Command as Command54, Option as Option51 } from "clipanion";
+import { Command as Command55, Option as Option52 } from "clipanion";
 
 // src/lib/foundry-create.ts
 init_errors();
@@ -29900,7 +30165,7 @@ async function createFoundryProject(args) {
 init_errors();
 var FoundryCreateCommand = class extends M8tCommand {
   static paths = [["foundry", "create"]];
-  static usage = Command54.Usage({
+  static usage = Command55.Usage({
     description: "Create an AI Foundry (AIServices) account + project + model deployment from scratch.",
     details: "Non-interactive and idempotent. Creates the AIServices account (custom subdomain + project management), a project, and a model deployment (default gpt-4.1-mini @ capacity 50). Region must be hosted-agent-eligible. Emits the project endpoint as structured output. Re-run is a clean no-op (account/project skipped if present; deployment capacity converges UP, never down).",
     examples: [
@@ -29909,16 +30174,16 @@ var FoundryCreateCommand = class extends M8tCommand {
       ["Higher capacity for a reasoning model", "$0 foundry create --resource-group rg-m8t-stack --location eastus2 --model gpt-5-mini --capacity 250"]
     ]
   });
-  resourceGroup = Option51.String("--resource-group");
-  location = Option51.String("--location");
-  account = Option51.String("--account");
-  project = Option51.String("--project", "m8t");
-  model = Option51.String("--model", "gpt-4.1-mini");
-  modelVersion = Option51.String("--model-version", "2025-04-14");
-  capacity = Option51.String("--capacity", "50");
-  subscription = Option51.String("--subscription");
-  skipQuotaCheck = Option51.Boolean("--skip-quota-check", false);
-  output = Option51.String("--output");
+  resourceGroup = Option52.String("--resource-group");
+  location = Option52.String("--location");
+  account = Option52.String("--account");
+  project = Option52.String("--project", "m8t");
+  model = Option52.String("--model", "gpt-4.1-mini");
+  modelVersion = Option52.String("--model-version", "2025-04-14");
+  capacity = Option52.String("--capacity", "50");
+  subscription = Option52.String("--subscription");
+  skipQuotaCheck = Option52.Boolean("--skip-quota-check", false);
+  output = Option52.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(
       this.output,
@@ -29990,22 +30255,22 @@ var FoundryCreateCommand = class extends M8tCommand {
 };
 
 // src/commands/foundry/await-ready.ts
-import { Command as Command55, Option as Option52 } from "clipanion";
+import { Command as Command56, Option as Option53 } from "clipanion";
 import { AzureCliCredential as AzureCliCredential3 } from "@azure/identity";
 init_errors();
 var FoundryAwaitReadyCommand = class extends M8tCommand {
   static paths = [["foundry", "await-ready"]];
-  static usage = Command55.Usage({
+  static usage = Command56.Usage({
     description: "Wait until a freshly-created Foundry project's data plane reliably serves it.",
     details: "Probes the project (GET /agents) until it returns 200 on a few consecutive tries, or fails clearly after a bounded budget. A newly-created account can serve intermittent 404 'Project not found' for minutes; run this after 'foundry create' and before deploying agents so the worker phase doesn't catch the unstable window.",
     examples: [["Wait for a project to be ready", "$0 foundry await-ready --endpoint https://acc.services.ai.azure.com/api/projects/m8t"]]
   });
-  endpoint = Option52.String("--endpoint");
-  consecutive = Option52.String("--consecutive", "3");
-  attempts = Option52.String("--attempts", "60");
-  interval = Option52.String("--interval", "5");
-  subscription = Option52.String("--subscription");
-  output = Option52.String("--output");
+  endpoint = Option53.String("--endpoint");
+  consecutive = Option53.String("--consecutive", "3");
+  attempts = Option53.String("--attempts", "60");
+  interval = Option53.String("--interval", "5");
+  subscription = Option53.String("--subscription");
+  output = Option53.String("--output");
   async executeCommand() {
     const mode = resolveOutputMode(this.output, this.context.stdout);
     const endpoint = typeof this.endpoint === "string" ? this.endpoint : void 0;
@@ -30039,7 +30304,7 @@ var FoundryAwaitReadyCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/preflight.ts
-import { Command as Command56, Option as Option53 } from "clipanion";
+import { Command as Command57, Option as Option54 } from "clipanion";
 
 // ../../packages/telemetry-contract/artifact/tier-map.ts
 var EVENT_TIERS = {
@@ -30065,9 +30330,9 @@ var DISCLOSURE_TIER1 = "Operational data. To support your installation, m8t rece
 
 // ../../packages/telemetry-contract/src/endpoints.ts
 var INGEST_BASE_URL = (process.env.M8T_INGEST_BASE_URL ?? "").trim() || "https://m8t-admin.wonderfuldesert-721e332f.eastus2.azurecontainerapps.io";
-function ingestUrl(path48) {
+function ingestUrl(path47) {
   const base = INGEST_BASE_URL.replace(/\/+$/, "");
-  return `${base}${path48.startsWith("/") ? path48 : `/${path48}`}`;
+  return `${base}${path47.startsWith("/") ? path47 : `/${path47}`}`;
 }
 
 // src/commands/bootstrap/preflight.ts
@@ -30091,7 +30356,7 @@ function preflightRenderable(results) {
 }
 var BootstrapPreflightCommand = class extends M8tCommand {
   static paths = [["bootstrap", "preflight"]];
-  static usage = Command56.Usage({
+  static usage = Command57.Usage({
     description: "Loudly verify you can install m8t (Owner/UAA + directory admin) and hard-stop if not.",
     details: "Step 1 of `m8t bootstrap`. Prints an unmissable admin-credentials notice, then checks: Owner or User Access Administrator at subscription scope (hard requirement), directory-admin capability to register the app (or pass --client-id), every Azure resource provider the install uses (registering any that are missing), soft-deleted Cognitive Services accounts (they keep their model quota until purged, so quota can read free and the model deployment still fail), and \u2014 with --location \u2014 model quota in the target region. Exits non-zero with the exact failing check + remedy. `m8t prereqs` runs the same substrate checks on their own.",
     examples: [
@@ -30100,9 +30365,9 @@ var BootstrapPreflightCommand = class extends M8tCommand {
       ["BYO app registration (directory guests)", "$0 bootstrap preflight --client-id <appId>"]
     ]
   });
-  clientId = Option53.String("--client-id");
-  subscription = Option53.String("--subscription");
-  location = Option53.String("--location", {
+  clientId = Option54.String("--client-id");
+  subscription = Option54.String("--subscription");
+  location = Option54.String("--location", {
     description: "Target region. Enables the model-quota check \u2014 without it, quota is not verified."
   });
   async executeCommand() {
@@ -30199,10 +30464,10 @@ ${colors.error("  " + why)}
 }
 
 // src/commands/bootstrap/launch.ts
-import * as fs35 from "fs";
+import * as fs34 from "fs";
 import * as os15 from "os";
-import * as path38 from "path";
-import { Command as Command57, Option as Option54 } from "clipanion";
+import * as path37 from "path";
+import { Command as Command58, Option as Option55 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-mi.ts
@@ -30358,9 +30623,9 @@ async function kickInstaller(s) {
 
 // src/lib/bootstrap-status.ts
 import { createHash as createHash6, randomUUID as randomUUID2 } from "crypto";
-import * as fs33 from "fs/promises";
+import * as fs32 from "fs/promises";
 import * as os13 from "os";
-import * as path36 from "path";
+import * as path35 from "path";
 init_errors();
 var STATUS_CONTAINER = "status";
 var STATUS_BLOB = "status.json";
@@ -30399,7 +30664,7 @@ async function readStatusBlob(opts) {
       cause: e
     });
   }
-  const tmpFile = path36.join(os13.tmpdir(), `m8t-status-${randomUUID2()}.json`);
+  const tmpFile = path35.join(os13.tmpdir(), `m8t-status-${randomUUID2()}.json`);
   try {
     await runAz([
       "storage",
@@ -30418,7 +30683,7 @@ async function readStatusBlob(opts) {
       "--no-progress",
       "--only-show-errors"
     ]);
-    const raw = await fs33.readFile(tmpFile, "utf8");
+    const raw = await fs32.readFile(tmpFile, "utf8");
     return JSON.parse(raw.trim());
   } catch (e) {
     throw new LocalCliError({
@@ -30428,23 +30693,23 @@ async function readStatusBlob(opts) {
       cause: e
     });
   } finally {
-    await fs33.rm(tmpFile, { force: true });
+    await fs32.rm(tmpFile, { force: true });
   }
 }
 
 // src/lib/bootstrap-state.ts
-import * as fs34 from "fs/promises";
+import * as fs33 from "fs/promises";
 import * as os14 from "os";
-import * as path37 from "path";
+import * as path36 from "path";
 function stateDir(home) {
-  return path37.join(home, ".m8t");
+  return path36.join(home, ".m8t");
 }
 function statePath(home) {
-  return path37.join(stateDir(home), "bootstrap.json");
+  return path36.join(stateDir(home), "bootstrap.json");
 }
 async function readBootstrapState(home = os14.homedir()) {
   try {
-    const raw = await fs34.readFile(statePath(home), "utf8");
+    const raw = await fs33.readFile(statePath(home), "utf8");
     return JSON.parse(raw);
   } catch (e) {
     if (e.code === "ENOENT") return null;
@@ -30452,10 +30717,10 @@ async function readBootstrapState(home = os14.homedir()) {
   }
 }
 async function writeBootstrapState(state, home = os14.homedir()) {
-  await fs34.mkdir(stateDir(home), { recursive: true });
+  await fs33.mkdir(stateDir(home), { recursive: true });
   const tmp = `${statePath(home)}.tmp`;
-  await fs34.writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
-  await fs34.rename(tmp, statePath(home));
+  await fs33.writeFile(tmp, JSON.stringify(state, null, 2), "utf8");
+  await fs33.rename(tmp, statePath(home));
 }
 
 // src/lib/bootstrap-occupancy.ts
@@ -30572,7 +30837,7 @@ var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {
   static paths = [["bootstrap", "launch"]];
-  static usage = Command57.Usage({
+  static usage = Command58.Usage({
     description: "Create + authorize the installer managed identity, then kick the cloud installer.",
     details: "Step 2 of `m8t bootstrap` (run after `preflight`). Ensures the resource group, creates the m8t app registration (or uses --client-id), creates a user-assigned managed identity granted Owner at subscription scope, and launches the published m8t-installer image as an ACI run-to-completion job under that identity. Writes ~/.m8t/bootstrap.json for `status` and `reap`, and threads your Azure object id so the installer can grant you the platform's data-plane roles itself.",
     examples: [
@@ -30583,26 +30848,26 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       ["Share a support contact", "$0 bootstrap launch --location eastus2 --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  location = Option54.String("--location");
-  resourceGroup = Option54.String("--resource-group");
-  clientId = Option54.String("--client-id");
-  subscription = Option54.String("--subscription");
-  installerTag = Option54.String("--installer-tag");
+  location = Option55.String("--location");
+  resourceGroup = Option55.String("--resource-group");
+  clientId = Option55.String("--client-id");
+  subscription = Option55.String("--subscription");
+  installerTag = Option55.String("--installer-tag");
   // Full image ref override (registry + repo + tag) — an escape hatch when the
   // default org/tag is wrong for the current CLI (e.g. a stale published build).
   // Wins over --installer-tag / the pinned default.
-  installerImage = Option54.String("--installer-image");
-  gatewayImageRef = Option54.String("--gateway-image-ref");
-  githubAppCreds = Option54.String("--github-app-creds");
-  contactEmail = Option54.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  company = Option54.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  installerImage = Option55.String("--installer-image");
+  gatewayImageRef = Option55.String("--gateway-image-ref");
+  githubAppCreds = Option55.String("--github-app-creds");
+  contactEmail = Option55.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  company = Option55.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
   // Value-carrying on purpose: a bare --force would be cargo-culted into
   // runbooks and harness prompts and erode the protection, whereas a faithful
   // paste can never accidentally carry the victim group's name. It AUTHORIZES
   // the target; --resource-group is what CHOOSES it.
-  reinstallInto = Option54.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
-  org = Option54.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
-  noBrains = Option54.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
+  reinstallInto = Option55.String("--reinstall-into", { description: "Consent to installing into --resource-group even though it already holds resources. Must match the target group's name." });
+  org = Option55.String("--org", { description: "Assert the GitHub App on disk is installed on this org; refuses on a mismatch." });
+  noBrains = Option55.Boolean("--no-brains", false, { description: "Install without brain-backed workers. For test and CI rigs; the supported install creates brains." });
   async executeCommand() {
     const location = typeof this.location === "string" ? this.location : void 0;
     if (!location) {
@@ -30641,13 +30906,13 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 `);
       return 0;
     }
-    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path38.join(os15.homedir(), ".m8t", "github-app.json");
+    const credsPath = typeof this.githubAppCreds === "string" ? this.githubAppCreds : path37.join(os15.homedir(), ".m8t", "github-app.json");
     const skipBrains = this.noBrains === true;
     const requestedOrg = typeof this.org === "string" ? this.org : void 0;
     let githubApp;
     if (skipBrains) {
       out("installing without brain-backed workers; no GitHub App credentials will be used");
-    } else if (!fs35.existsSync(credsPath)) {
+    } else if (!fs34.existsSync(credsPath)) {
       this.context.stderr.write(buildMissingCredsRefusal(credsPath));
       throw new LocalCliError({
         code: "GITHUB_APP_CREDS_MISSING",
@@ -30657,7 +30922,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
     } else {
       let parsed;
       try {
-        parsed = JSON.parse(fs35.readFileSync(credsPath, "utf8"));
+        parsed = JSON.parse(fs34.readFileSync(credsPath, "utf8"));
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_CREDS_INVALID",
@@ -30675,7 +30940,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
       }
       let pem;
       try {
-        pem = fs35.readFileSync(parsed.pemPath, "utf8");
+        pem = fs34.readFileSync(parsed.pemPath, "utf8");
       } catch {
         throw new LocalCliError({
           code: "GITHUB_APP_PEM_MISSING",
@@ -30763,7 +31028,7 @@ var BootstrapLaunchCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/status.ts
-import { Command as Command59, Option as Option56 } from "clipanion";
+import { Command as Command60, Option as Option57 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-aci-state.ts
@@ -30789,15 +31054,15 @@ async function getAciState(opts) {
 }
 
 // src/lib/bootstrap-finalize.ts
-import * as fs39 from "fs/promises";
+import * as fs38 from "fs/promises";
 import * as os19 from "os";
-import * as path44 from "path";
+import * as path43 from "path";
 
 // src/lib/company-profile-seed.ts
 import { spawn as spawn6 } from "child_process";
-import { closeSync, openSync, readFileSync as readFileSync25 } from "fs";
+import { closeSync, openSync, readFileSync as readFileSync24 } from "fs";
 import * as os16 from "os";
-import * as path39 from "path";
+import * as path38 from "path";
 init_errors();
 
 // src/lib/onboarding-profile.ts
@@ -31522,9 +31787,9 @@ function composeFounderIdentityNote(id) {
 
 // src/lib/company-profile-seed.ts
 function readGithubAppCreds(credsPath) {
-  const p = credsPath ?? path39.join(os16.homedir(), ".m8t", "github-app.json");
+  const p = credsPath ?? path38.join(os16.homedir(), ".m8t", "github-app.json");
   try {
-    return JSON.parse(readFileSync25(p, "utf8"));
+    return JSON.parse(readFileSync24(p, "utf8"));
   } catch {
     return null;
   }
@@ -31593,7 +31858,7 @@ function upsertMemoryIndexOnce(existing, line2, targetPath2) {
 async function applyProfileToBrain(args) {
   const token = await mintInstallationTokenFromPem({
     appId: args.appCreds.appId,
-    privateKeyPem: readFileSync25(args.appCreds.pemPath, "utf8"),
+    privateKeyPem: readFileSync24(args.appCreds.pemPath, "utf8"),
     installationId: args.appCreds.installationId,
     fetchImpl: args.fetchImpl
   });
@@ -31683,7 +31948,7 @@ async function applyProfileToBrains(args) {
   }
 }
 function spawnDetachedSeedWatch() {
-  const logPath = path39.join(os16.homedir(), ".m8t", "seed-profile.log");
+  const logPath = path38.join(os16.homedir(), ".m8t", "seed-profile.log");
   const fd = openSync(logPath, "a");
   try {
     const child = spawn6(process.execPath, [process.argv[1] ?? "", "bootstrap", "seed-profile", "--watch"], {
@@ -31761,16 +32026,16 @@ function renderInstallSummary(args) {
 
 // src/lib/companion-install.ts
 import { constants as constants2 } from "fs";
-import * as fs37 from "fs/promises";
-import * as path41 from "path";
+import * as fs36 from "fs/promises";
+import * as path40 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 import { execFile, spawn as spawn7 } from "child_process";
 
 // src/lib/companion-artifact.ts
 import { createHash as createHash7 } from "crypto";
 import { constants } from "fs";
-import * as fs36 from "fs/promises";
-import * as path40 from "path";
+import * as fs35 from "fs/promises";
+import * as path39 from "path";
 var SHA256 = /^[a-f0-9]{64}$/u;
 var VERSION2 = /^[A-Za-z0-9][A-Za-z0-9._+-]{0,127}$/u;
 function exactKeys(value, expected) {
@@ -31778,23 +32043,23 @@ function exactKeys(value, expected) {
   return actual.length === expected.length && actual.every((key2, index) => key2 === [...expected].sort()[index]);
 }
 function normalizedRelative(value) {
-  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path40.posix.isAbsolute(value)) {
+  if (value.length === 0 || value.includes("\\") || value.includes("\0") || path39.posix.isAbsolute(value)) {
     throw new Error("Artifact path must be a normalized relative POSIX path");
   }
-  const normalized = path40.posix.normalize(value);
+  const normalized = path39.posix.normalize(value);
   if (normalized !== value || normalized === "." || normalized === ".." || normalized.startsWith("../")) {
     throw new Error("Artifact path escapes the payload root");
   }
   return value;
 }
 function validateLink(entryPath, target) {
-  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path40.posix.isAbsolute(target)) {
+  if (target.length === 0 || target.includes("\\") || target.includes("\0") || path39.posix.isAbsolute(target)) {
     throw new Error("Artifact symlink target must be relative");
   }
-  const resolved = path40.posix.normalize(
-    path40.posix.join(path40.posix.dirname(entryPath), target)
+  const resolved = path39.posix.normalize(
+    path39.posix.join(path39.posix.dirname(entryPath), target)
   );
-  if (resolved === ".." || resolved.startsWith("../") || path40.posix.isAbsolute(resolved)) {
+  if (resolved === ".." || resolved.startsWith("../") || path39.posix.isAbsolute(resolved)) {
     throw new Error("Artifact symlink target escapes the payload root");
   }
   return target;
@@ -31875,17 +32140,17 @@ function parseArtifactManifest(value) {
   };
 }
 async function sha256File2(filePath) {
-  return createHash7("sha256").update(await fs36.readFile(filePath)).digest("hex");
+  return createHash7("sha256").update(await fs35.readFile(filePath)).digest("hex");
 }
 async function walk2(root, relative4 = "") {
-  const directory = path40.join(root, ...relative4.split("/").filter(Boolean));
-  const children = await fs36.readdir(directory, { withFileTypes: true });
+  const directory = path39.join(root, ...relative4.split("/").filter(Boolean));
+  const children = await fs35.readdir(directory, { withFileTypes: true });
   const entries = [];
   for (const child of children.sort((left, right) => left.name.localeCompare(right.name))) {
     const childRelative = relative4 ? `${relative4}/${child.name}` : child.name;
     normalizedRelative(childRelative);
-    const childPath = path40.join(directory, child.name);
-    const stat5 = await fs36.lstat(childPath);
+    const childPath = path39.join(directory, child.name);
+    const stat5 = await fs35.lstat(childPath);
     if (stat5.isDirectory()) {
       entries.push(...await walk2(root, childRelative));
     } else if (stat5.isFile()) {
@@ -31897,7 +32162,7 @@ async function walk2(root, relative4 = "") {
         sha256: await sha256File2(childPath)
       });
     } else if (stat5.isSymbolicLink()) {
-      const target = await fs36.readlink(childPath);
+      const target = await fs35.readlink(childPath);
       entries.push({
         type: "symlink",
         path: childRelative,
@@ -31910,19 +32175,19 @@ async function walk2(root, relative4 = "") {
   return entries;
 }
 async function ensureRealDirectory(root) {
-  const stat5 = await fs36.lstat(root);
+  const stat5 = await fs35.lstat(root);
   if (stat5.isSymbolicLink()) throw new Error("Artifact root is a symbolic link");
   if (!stat5.isDirectory()) throw new Error("Artifact root is not a directory");
 }
 async function validateResolvedLinks(root, entries) {
-  const realRoot = await fs36.realpath(root);
+  const realRoot = await fs35.realpath(root);
   for (const entry of entries) {
     if (entry.type !== "symlink") continue;
     try {
-      const linkPath = path40.join(root, ...entry.path.split("/"));
-      const resolved = await fs36.realpath(linkPath);
-      const relative4 = path40.relative(realRoot, resolved);
-      if (relative4 === ".." || relative4.startsWith(`..${path40.sep}`) || path40.isAbsolute(relative4)) {
+      const linkPath = path39.join(root, ...entry.path.split("/"));
+      const resolved = await fs35.realpath(linkPath);
+      const relative4 = path39.relative(realRoot, resolved);
+      if (relative4 === ".." || relative4.startsWith(`..${path39.sep}`) || path39.isAbsolute(relative4)) {
         throw new Error("Artifact symlink chain escapes the payload root");
       }
     } catch (error) {
@@ -31952,13 +32217,13 @@ async function buildArtifactManifest(payloadRoot, input) {
   return manifest;
 }
 async function readArtifactManifest(manifestPath) {
-  const before = await fs36.lstat(manifestPath);
+  const before = await fs35.lstat(manifestPath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Artifact manifest is a symbolic link or non-file");
   }
   let handle;
   try {
-    handle = await fs36.open(
+    handle = await fs35.open(
       manifestPath,
       constants.O_RDONLY | constants.O_NOFOLLOW
     );
@@ -31975,9 +32240,9 @@ async function readArtifactManifest(manifestPath) {
   }
 }
 function ensureContainedEntry(root, entryPath) {
-  const absolute = path40.join(root, ...entryPath.split("/"));
-  const relative4 = path40.relative(root, absolute);
-  if (relative4.startsWith("..") || path40.isAbsolute(relative4)) {
+  const absolute = path39.join(root, ...entryPath.split("/"));
+  const relative4 = path39.relative(root, absolute);
+  if (relative4.startsWith("..") || path39.isAbsolute(relative4)) {
     throw new Error("Artifact entry escapes payload root");
   }
   return absolute;
@@ -32016,27 +32281,27 @@ async function verifyArtifactPayload(payloadRoot, manifest) {
 async function copyArtifactPayload(sourceRoot, targetRoot, manifest) {
   await verifyArtifactSource(sourceRoot, manifest);
   try {
-    const targetStat = await fs36.lstat(targetRoot);
+    const targetStat = await fs35.lstat(targetRoot);
     if (targetStat.isSymbolicLink()) {
       throw new Error("Install target is a symbolic link");
     }
     if (!targetStat.isDirectory()) throw new Error("Install target is not a directory");
-    if ((await fs36.readdir(targetRoot)).length > 0) {
+    if ((await fs35.readdir(targetRoot)).length > 0) {
       throw new Error("Install staging target is not empty");
     }
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
-    await fs36.mkdir(targetRoot, { recursive: false, mode: 448 });
+    await fs35.mkdir(targetRoot, { recursive: false, mode: 448 });
   }
   for (const entry of manifest.entries) {
     const source = ensureContainedEntry(sourceRoot, entry.path);
     const target = ensureContainedEntry(targetRoot, entry.path);
-    await fs36.mkdir(path40.dirname(target), { recursive: true, mode: 448 });
+    await fs35.mkdir(path39.dirname(target), { recursive: true, mode: 448 });
     if (entry.type === "file") {
-      await fs36.copyFile(source, target);
-      await fs36.chmod(target, entry.mode);
+      await fs35.copyFile(source, target);
+      await fs35.chmod(target, entry.mode);
     } else {
-      await fs36.symlink(entry.target, target);
+      await fs35.symlink(entry.target, target);
     }
   }
   await verifyArtifactPayload(targetRoot, manifest);
@@ -32075,17 +32340,17 @@ function execFileOutput(file, args) {
 }
 async function setCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const launchAgents = path41.join(input.homeDirectory, "Library", "LaunchAgents");
-    const registration = path41.join(
+    const launchAgents = path40.join(input.homeDirectory, "Library", "LaunchAgents");
+    const registration = path40.join(
       launchAgents,
       "com.m8t.companion.plist"
     );
     await assertNotSymlink(registration, "Start-at-login registration");
     if (!input.enabled) {
-      await fs37.rm(registration, { force: true });
+      await fs36.rm(registration, { force: true });
       return;
     }
-    await fs37.mkdir(launchAgents, { recursive: true, mode: 448 });
+    await fs36.mkdir(launchAgents, { recursive: true, mode: 448 });
     const plist = '<?xml version="1.0" encoding="UTF-8"?>\n<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">\n<plist version="1.0"><dict><key>Label</key><string>com.m8t.companion</string><key>ProgramArguments</key><array><string>' + xmlEscape(input.executable) + "</string></array><key>RunAtLoad</key><true/></dict></plist>\n";
     await atomicWriteText(registration, plist, 384);
     return;
@@ -32137,7 +32402,7 @@ async function setCompanionStartAtLogin(input) {
 }
 async function getCompanionStartAtLogin(input) {
   if (input.platform === "darwin") {
-    const registration = path41.join(
+    const registration = path40.join(
       input.homeDirectory,
       "Library",
       "LaunchAgents",
@@ -32199,26 +32464,26 @@ function assertSupported(options) {
 }
 function companionInstallPaths(options) {
   assertSupported(options);
-  const companionState = path41.join(
+  const companionState = path40.join(
     options.homeDirectory,
     ".m8t",
     "companion"
   );
-  const targetRoot = options.platform === "darwin" ? path41.join(
+  const targetRoot = options.platform === "darwin" ? path40.join(
     options.homeDirectory,
     "Applications",
     "m8t Companion.app"
-  ) : path41.join(
-    options.localAppData ?? path41.join(options.homeDirectory, "AppData", "Local"),
+  ) : path40.join(
+    options.localAppData ?? path40.join(options.homeDirectory, "AppData", "Local"),
     "m8t",
     "companion",
     "app"
   );
   return {
     targetRoot,
-    installManifest: path41.join(companionState, "install-v1.json"),
-    runtimeBinding: path41.join(companionState, "runtime-v1.json"),
-    preferences: path41.join(companionState, "preferences-v1.json")
+    installManifest: path40.join(companionState, "install-v1.json"),
+    runtimeBinding: path40.join(companionState, "runtime-v1.json"),
+    preferences: path40.join(companionState, "preferences-v1.json")
   };
 }
 function exactKeys2(value, keys) {
@@ -32229,7 +32494,7 @@ function parseInstallManifest(value) {
     throw new Error("Install manifest schema is invalid");
   }
   const record = value;
-  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path41.isAbsolute(record.ownedTargetRoot)) {
+  if (!exactKeys2(record, INSTALL_KEYS) || record.schemaVersion !== 1 || typeof record.version !== "string" || record.platform !== "darwin" && record.platform !== "win32" || record.architecture !== "arm64" && record.architecture !== "x64" || typeof record.entryRelativePath !== "string" || typeof record.artifactTreeSha256 !== "string" || !/^[a-f0-9]{64}$/u.test(record.artifactTreeSha256) || typeof record.ownedTargetRoot !== "string" || !path40.isAbsolute(record.ownedTargetRoot)) {
     throw new Error("Install manifest schema is invalid");
   }
   return record;
@@ -32239,7 +32504,7 @@ function parseRuntimeBinding(value, platform) {
     throw new Error("Runtime binding schema is invalid");
   }
   const record = value;
-  const paths = platform === "win32" ? path41.win32 : path41.posix;
+  const paths = platform === "win32" ? path40.win32 : path40.posix;
   if (!exactKeys2(record, RUNTIME_KEYS) || record.schemaVersion !== 1 || typeof record.nodeExecutable !== "string" || !paths.isAbsolute(record.nodeExecutable) || typeof record.cliEntry !== "string" || !paths.isAbsolute(record.cliEntry) || typeof record.gatewayOrigin !== "string") {
     throw new Error("Runtime binding schema is invalid");
   }
@@ -32264,7 +32529,7 @@ function validateGatewayOrigin(value) {
 }
 async function assertNotSymlink(filePath, kind) {
   try {
-    if ((await fs37.lstat(filePath)).isSymbolicLink()) {
+    if ((await fs36.lstat(filePath)).isSymbolicLink()) {
       throw new Error(`${kind} is a symbolic link`);
     }
   } catch (error) {
@@ -32273,20 +32538,20 @@ async function assertNotSymlink(filePath, kind) {
   }
 }
 async function assertOwnedDirectoryChain(anchor, targetDirectory) {
-  const relative4 = path41.relative(anchor, targetDirectory);
-  if (relative4 === ".." || relative4.startsWith(`..${path41.sep}`) || path41.isAbsolute(relative4)) {
+  const relative4 = path40.relative(anchor, targetDirectory);
+  if (relative4 === ".." || relative4.startsWith(`..${path40.sep}`) || path40.isAbsolute(relative4)) {
     throw new Error("Companion owned directory escapes its trusted anchor");
   }
-  const segments = relative4.split(path41.sep).filter(Boolean);
+  const segments = relative4.split(path40.sep).filter(Boolean);
   let current = anchor;
-  const anchorStatus = await fs37.lstat(anchor);
+  const anchorStatus = await fs36.lstat(anchor);
   if (anchorStatus.isSymbolicLink() || !anchorStatus.isDirectory()) {
     throw new Error("Companion owned directory anchor is unsafe");
   }
   for (const segment of segments) {
-    current = path41.join(current, segment);
+    current = path40.join(current, segment);
     try {
-      const status = await fs37.lstat(current);
+      const status = await fs36.lstat(current);
       if (status.isSymbolicLink() || !status.isDirectory()) {
         throw new Error("Companion owned directory contains a symbolic link");
       }
@@ -32299,19 +32564,19 @@ async function assertOwnedDirectoryChain(anchor, targetDirectory) {
 async function assertOwnedParents(options, paths) {
   await assertOwnedDirectoryChain(
     options.homeDirectory,
-    path41.dirname(paths.installManifest)
+    path40.dirname(paths.installManifest)
   );
-  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path41.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
-  await assertOwnedDirectoryChain(targetAnchor, path41.dirname(paths.targetRoot));
+  const targetAnchor = options.platform === "win32" ? options.localAppData ?? path40.join(options.homeDirectory, "AppData", "Local") : options.homeDirectory;
+  await assertOwnedDirectoryChain(targetAnchor, path40.dirname(paths.targetRoot));
 }
 async function readRegularText(filePath, maxBytes) {
-  const before = await fs37.lstat(filePath);
+  const before = await fs36.lstat(filePath);
   if (before.isSymbolicLink() || !before.isFile()) {
     throw new Error("Companion state file is not a regular file");
   }
   let handle;
   try {
-    handle = await fs37.open(
+    handle = await fs36.open(
       filePath,
       constants2.O_RDONLY | constants2.O_NOFOLLOW
     );
@@ -32334,27 +32599,27 @@ async function atomicWriteJson(filePath, value) {
 }
 async function atomicWriteText(filePath, contents, mode) {
   await assertNotSymlink(filePath, "Companion state file");
-  await fs37.mkdir(path41.dirname(filePath), {
+  await fs36.mkdir(path40.dirname(filePath), {
     recursive: true,
     mode: 448
   });
   const temporary = `${filePath}.${randomUUID3()}.tmp`;
   try {
-    await fs37.writeFile(temporary, contents, {
+    await fs36.writeFile(temporary, contents, {
       mode,
       flag: "wx"
     });
-    await fs37.rename(temporary, filePath);
-    await fs37.chmod(filePath, mode).catch(() => void 0);
+    await fs36.rename(temporary, filePath);
+    await fs36.chmod(filePath, mode).catch(() => void 0);
   } finally {
-    await fs37.rm(temporary, { force: true }).catch(() => void 0);
+    await fs36.rm(temporary, { force: true }).catch(() => void 0);
   }
 }
 async function realRegularFile(filePath, executable) {
-  const real = await fs37.realpath(filePath);
-  const stat5 = await fs37.stat(real);
+  const real = await fs36.realpath(filePath);
+  const stat5 = await fs36.stat(real);
   if (!stat5.isFile()) throw new Error("Companion launch target is not a file");
-  await fs37.access(real, executable ? constants2.X_OK : constants2.R_OK);
+  await fs36.access(real, executable ? constants2.X_OK : constants2.R_OK);
   return real;
 }
 function defaultLaunch(executable) {
@@ -32370,7 +32635,7 @@ async function companionIsRunning(platform, executable) {
   if (platform !== "win32") return false;
   let handle;
   try {
-    handle = await fs37.open(executable, "r+");
+    handle = await fs36.open(executable, "r+");
   } catch (error) {
     const code = error.code;
     if (code === "ENOENT") return false;
@@ -32451,7 +32716,7 @@ async function statusCompanion(options) {
       realRegularFile(runtime.nodeExecutable, options.platform !== "win32"),
       realRegularFile(runtime.cliEntry, false)
     ]);
-    const executable = path41.join(
+    const executable = path40.join(
       paths.targetRoot,
       ...install.entryRelativePath.split("/")
     );
@@ -32484,7 +32749,7 @@ async function snapshotFile(filePath) {
 }
 async function restoreFile(filePath, bytes) {
   if (bytes === null) {
-    await fs37.rm(filePath, { force: true });
+    await fs36.rm(filePath, { force: true });
   } else {
     await atomicWriteJson(filePath, JSON.parse(bytes.toString("utf8")));
   }
@@ -32499,8 +32764,8 @@ async function converge(options, force) {
   if (artifactManifest.platform !== options.platform || artifactManifest.architecture !== options.architecture) {
     throw new Error("Companion artifact does not match this OS and architecture");
   }
-  const payloadRoot = path41.join(
-    path41.dirname(options.artifactManifestPath),
+  const payloadRoot = path40.join(
+    path40.dirname(options.artifactManifestPath),
     "payload"
   );
   await verifyArtifactSource(payloadRoot, artifactManifest);
@@ -32520,7 +32785,7 @@ async function converge(options, force) {
   if (priorInstalled) {
     await assertCompanionNotRunning(
       options,
-      path41.join(
+      path40.join(
         priorInstalled.paths.targetRoot,
         ...priorInstalled.install.entryRelativePath.split("/")
       )
@@ -32528,7 +32793,7 @@ async function converge(options, force) {
   }
   if (current.state === "not-installed") {
     try {
-      await fs37.lstat(paths.targetRoot);
+      await fs36.lstat(paths.targetRoot);
       throw new Error(
         "The fixed companion target exists without an owned install manifest"
       );
@@ -32539,7 +32804,7 @@ async function converge(options, force) {
   const stage = `${paths.targetRoot}.m8t-stage-${randomUUID3()}`;
   const backup = `${paths.targetRoot}.m8t-backup-${randomUUID3()}`;
   const copy = options.copyPayload ?? copyArtifactPayload;
-  await fs37.mkdir(path41.dirname(paths.targetRoot), {
+  await fs36.mkdir(path40.dirname(paths.targetRoot), {
     recursive: true,
     mode: 448
   });
@@ -32556,12 +32821,12 @@ async function converge(options, force) {
   try {
     await copy(payloadRoot, stage, artifactManifest);
     try {
-      await fs37.rename(paths.targetRoot, backup);
+      await fs36.rename(paths.targetRoot, backup);
       movedPrior = true;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
-    await fs37.rename(stage, paths.targetRoot);
+    await fs36.rename(stage, paths.targetRoot);
     installedStage = true;
     const nodeExecutable = await realRegularFile(
       options.nodeExecutable,
@@ -32603,7 +32868,7 @@ async function converge(options, force) {
       await readClosedJson(paths.runtimeBinding),
       options.platform
     );
-    const executable = path41.join(
+    const executable = path40.join(
       paths.targetRoot,
       ...artifactManifest.entryRelativePath.split("/")
     );
@@ -32613,7 +32878,7 @@ async function converge(options, force) {
       platform: options.platform,
       executable: ownedExecutable
     }));
-    priorLoginExecutable = priorInstalled ? path41.join(
+    priorLoginExecutable = priorInstalled ? path40.join(
       priorInstalled.paths.targetRoot,
       ...priorInstalled.install.entryRelativePath.split("/")
     ) : executable;
@@ -32624,7 +32889,7 @@ async function converge(options, force) {
     );
     loginChanged = true;
     await (options.launch ?? defaultLaunch)(executable);
-    await fs37.rm(backup, { recursive: true, force: true });
+    await fs36.rm(backup, { recursive: true, force: true });
     return {
       state: "installed",
       version: artifactManifest.version,
@@ -32638,15 +32903,15 @@ async function converge(options, force) {
         () => void 0
       );
     }
-    await fs37.rm(stage, { recursive: true, force: true }).catch(() => void 0);
+    await fs36.rm(stage, { recursive: true, force: true }).catch(() => void 0);
     if (installedStage) {
-      await fs37.rm(paths.targetRoot, {
+      await fs36.rm(paths.targetRoot, {
         recursive: true,
         force: true
       }).catch(() => void 0);
     }
     if (movedPrior) {
-      await fs37.rename(backup, paths.targetRoot).catch(() => void 0);
+      await fs36.rename(backup, paths.targetRoot).catch(() => void 0);
     }
     await Promise.all([
       restoreFile(paths.installManifest, snapshots[0]),
@@ -32672,14 +32937,14 @@ async function uninstallCompanion(options) {
   if (install.ownedTargetRoot !== paths.targetRoot) {
     throw new Error("Refusing to remove a non-owned companion target");
   }
-  const executable = path41.join(
+  const executable = path40.join(
     paths.targetRoot,
     ...install.entryRelativePath.split("/")
   );
   await assertCompanionNotRunning(options, executable);
   await (options.setStartAtLogin ?? (() => Promise.resolve()))(executable, false);
   const remove = options.removeOwnedPath ?? (async (ownedPath, recursive) => {
-    await fs37.rm(ownedPath, { recursive, force: true });
+    await fs36.rm(ownedPath, { recursive, force: true });
   });
   await remove(paths.targetRoot, true);
   await remove(paths.installManifest, false);
@@ -32690,8 +32955,8 @@ async function uninstallCompanion(options) {
 
 // src/commands/companion/install.ts
 import * as os18 from "os";
-import * as path43 from "path";
-import { Command as Command58, Option as Option55 } from "clipanion";
+import * as path42 from "path";
+import { Command as Command59, Option as Option56 } from "clipanion";
 
 // src/lib/companion-channel.ts
 async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps = {}) {
@@ -32708,9 +32973,9 @@ async function readCompanionRelease(source = { url: CHANNEL_LATEST_URL }, deps =
 // src/lib/companion-download.ts
 import { createHash as createHash8 } from "crypto";
 import { execFile as execFile2 } from "child_process";
-import * as fs38 from "fs/promises";
+import * as fs37 from "fs/promises";
 import * as os17 from "os";
-import * as path42 from "path";
+import * as path41 from "path";
 init_errors();
 var MAX_ASSET_BYTES = 512 * 1024 * 1024;
 function extractArchive(archive, into) {
@@ -32763,20 +33028,20 @@ async function downloadCompanionArtifact(component, deps = {}) {
       hint: "Nothing was unpacked. This is what a corrupted download or a substituted file looks like \u2014 retry, and report it if it persists."
     });
   }
-  const root = await (deps.makeTemporaryDirectory ?? (() => fs38.mkdtemp(path42.join(os17.tmpdir(), "m8t-companion-"))))();
+  const root = await (deps.makeTemporaryDirectory ?? (() => fs37.mkdtemp(path41.join(os17.tmpdir(), "m8t-companion-"))))();
   const dispose = async () => {
-    await fs38.rm(root, { recursive: true, force: true }).catch(() => void 0);
+    await fs37.rm(root, { recursive: true, force: true }).catch(() => void 0);
   };
   try {
-    const archive = path42.join(root, pinned.asset);
-    await fs38.writeFile(archive, bytes, { mode: 384 });
-    const unpacked = path42.join(root, "unpacked");
-    await fs38.mkdir(unpacked, { recursive: false, mode: 448 });
+    const archive = path41.join(root, pinned.asset);
+    await fs37.writeFile(archive, bytes, { mode: 384 });
+    const unpacked = path41.join(root, "unpacked");
+    await fs37.mkdir(unpacked, { recursive: false, mode: 448 });
     await (deps.extract ?? extractArchive)(archive, unpacked);
-    await fs38.rm(archive, { force: true });
+    await fs37.rm(archive, { force: true });
     return {
       version: component.version,
-      artifactManifestPath: path42.join(unpacked, "artifact-v1.json"),
+      artifactManifestPath: path41.join(unpacked, "artifact-v1.json"),
       dispose
     };
   } catch (error) {
@@ -32807,7 +33072,7 @@ async function convergeCompanionFromChannel(converge2, options = {}) {
   let artifactManifestPath;
   let dispose = () => Promise.resolve();
   if (stagedDirectory !== void 0) {
-    artifactManifestPath = path43.resolve(stagedDirectory, "artifact-v1.json");
+    artifactManifestPath = path42.resolve(stagedDirectory, "artifact-v1.json");
   } else {
     const release = await readCompanionRelease(
       platformVersion !== void 0 ? { channel: true, version: platformTag(platformVersion) } : { url: CHANNEL_LATEST_URL }
@@ -32849,7 +33114,7 @@ Version: ${state.version}
 }
 var CompanionInstallCommand = class extends M8tCommand {
   static paths = [["companion", "install"]];
-  static usage = Command58.Usage({
+  static usage = Command59.Usage({
     description: "Install the desktop companions for this user from the release channel.",
     examples: [
       ["Install the released build", "$0 companion install"],
@@ -32859,10 +33124,10 @@ var CompanionInstallCommand = class extends M8tCommand {
       ]
     ]
   });
-  from = Option55.String("--from", {
+  from = Option56.String("--from", {
     description: "A locally staged build directory instead of the released one."
   });
-  resourceGroup = Option55.String("--resource-group", {
+  resourceGroup = Option56.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -32885,7 +33150,7 @@ function resolveRepoRootMarker(args) {
 }
 async function looksLikeCheckout(dir) {
   try {
-    return (await fs39.stat(path44.join(dir, "brain-template"))).isDirectory();
+    return (await fs38.stat(path43.join(dir, "brain-template"))).isDirectory();
   } catch {
     return false;
   }
@@ -32904,18 +33169,18 @@ var defaultDeps3 = {
   homedir: () => os19.homedir()
 };
 async function finalizeInstall(args, deps = defaultDeps3) {
-  const markerDir = path44.join(deps.homedir(), ".m8t");
-  const markerPath = path44.join(markerDir, "repo-root");
+  const markerDir = path43.join(deps.homedir(), ".m8t");
+  const markerPath = path43.join(markerDir, "repo-root");
   const cwd = process.cwd();
-  const existing = await fs39.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
+  const existing = await fs38.readFile(markerPath, "utf8").then((s) => s.trim()).catch(() => null);
   const repoRoot = resolveRepoRootMarker({
     ...args.repoRoot !== void 0 ? { explicit: args.repoRoot } : {},
     cwd,
     cwdIsCheckout: await looksLikeCheckout(cwd),
     existing
   });
-  await fs39.mkdir(markerDir, { recursive: true });
-  await fs39.writeFile(markerPath, `${repoRoot}
+  await fs38.mkdir(markerDir, { recursive: true });
+  await fs38.writeFile(markerPath, `${repoRoot}
 `, "utf8");
   let webappUrl;
   try {
@@ -32993,7 +33258,7 @@ async function finalizeInstall(args, deps = defaultDeps3) {
   }
   let brainOrg = null;
   try {
-    const credsRaw = await fs39.readFile(path44.join(markerDir, "github-app.json"), "utf8");
+    const credsRaw = await fs38.readFile(path43.join(markerDir, "github-app.json"), "utf8");
     const creds = JSON.parse(credsRaw);
     brainOrg = typeof creds.org === "string" ? creds.org : null;
   } catch {
@@ -33078,7 +33343,7 @@ var BootstrapStatusCommand = class extends M8tCommand {
   // runbooks and shakedown recipes that a founder may already be part-way
   // through — it prints a deprecation notice and does the right thing.
   static paths = [["bootstrap", "status"], ["bootstrap", "finish"]];
-  static usage = Command59.Usage({
+  static usage = Command60.Usage({
     description: "Show the cloud installer's live status (phase, progress, result) \u2014 and finish the local setup when it lands.",
     details: "Reads the durable status blob written by the installer. --watch polls until the install reaches done or failed.\n\nOn reaching done under --watch this also completes the local half of the install, which nothing else in the bootstrap path can do: it registers the webapp's sign-in redirect URI (the installer runs as a managed identity with no directory role, and at launch time the gateway FQDN did not exist yet), writes ~/.m8t/repo-root and the gateway discovery cache, and seeds your advisors' brains from the onboarding intake. Re-runnable \u2014 `m8t bootstrap finish` is a deprecated alias that does exactly this on an already-done install.",
     examples: [
@@ -33087,12 +33352,12 @@ var BootstrapStatusCommand = class extends M8tCommand {
       ["Redo the local setup on a finished install", "$0 bootstrap status --finalize --repo-root /path/to/m8t"]
     ]
   });
-  watch = Option56.Boolean("--watch", false);
-  output = Option56.String("--output");
-  repoRoot = Option56.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
-  finalize = Option56.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
-  subscription = Option56.String("--subscription");
-  resourceGroup = Option56.String("--resource-group");
+  watch = Option57.Boolean("--watch", false);
+  output = Option57.String("--output");
+  repoRoot = Option57.String("--repo-root", { description: "The m8t clone to point local tools at (default: the current directory)." });
+  finalize = Option57.Boolean("--finalize", false, { description: "Complete the local setup against an already-done install, without watching." });
+  subscription = Option57.String("--subscription");
+  resourceGroup = Option57.String("--resource-group");
   async executeCommand() {
     const state = await readBootstrapState();
     if (!state) {
@@ -33225,7 +33490,7 @@ function formatStatus(d) {
 }
 
 // src/commands/bootstrap/reap.ts
-import { Command as Command60, Option as Option57 } from "clipanion";
+import { Command as Command61, Option as Option58 } from "clipanion";
 init_errors();
 
 // src/lib/bootstrap-reap.ts
@@ -33319,7 +33584,7 @@ async function reapInstaller(opts) {
 // src/commands/bootstrap/reap.ts
 var BootstrapReapCommand = class extends M8tCommand {
   static paths = [["bootstrap", "reap"]];
-  static usage = Command60.Usage({
+  static usage = Command61.Usage({
     description: "Tear down the installer scaffolding (ACI \u2192 MI \u2192 its role assignments) after a successful install.",
     details: "Runs locally on the 'done' signal (the installer can't delete its own identity). The platform RG and the gateway's own assignments persist. A failed install is left intact for diagnosis unless --force.\n\n--sweep-orphans is a DIFFERENT and much broader mode: instead of reaping this install, it scans the WHOLE SUBSCRIPTION for m8t role assignments left behind by installs whose resources are gone \u2014 orphaned installer Owner-at-subscription-scope grants and orphaned gateway subscription-scope roles. It is a dry run that only lists what it found unless you also pass --yes, which deletes them.",
     examples: [
@@ -33329,9 +33594,9 @@ var BootstrapReapCommand = class extends M8tCommand {
       ["\u2026and delete them", "$0 bootstrap reap --sweep-orphans --yes"]
     ]
   });
-  force = Option57.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
-  sweepOrphans = Option57.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
-  yes = Option57.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
+  force = Option58.Boolean("--force", false, { description: "Reap even if the install failed or never reported a status." });
+  sweepOrphans = Option58.Boolean("--sweep-orphans", false, { description: "Subscription-wide: find m8t role assignments orphaned by earlier installs. Lists only, unless --yes." });
+  yes = Option58.Boolean("--yes", false, { description: "With --sweep-orphans, actually delete what the sweep found." });
   async executeCommand() {
     if (this.sweepOrphans === true) {
       const { subscriptionId: sub } = await getAzAccount();
@@ -33425,18 +33690,18 @@ Found ${String(total)} orphaned assignment(s) (${breakdown}) (dry-run). ${colors
 };
 
 // src/commands/bootstrap/ui.ts
-import * as fs41 from "fs";
+import * as fs40 from "fs";
 import * as os21 from "os";
-import * as path46 from "path";
-import { Command as Command61, Option as Option58 } from "clipanion";
-import { DefaultAzureCredential as DefaultAzureCredential24 } from "@azure/identity";
+import * as path45 from "path";
+import { Command as Command62, Option as Option59 } from "clipanion";
+import { DefaultAzureCredential as DefaultAzureCredential25 } from "@azure/identity";
 init_errors();
 
 // src/lib/bootstrap-ui.ts
-import * as fs40 from "fs";
+import * as fs39 from "fs";
 import * as net from "net";
 import * as os20 from "os";
-import * as path45 from "path";
+import * as path44 from "path";
 import { randomBytes as randomBytes3 } from "crypto";
 import { spawn as spawn8, spawnSync as spawnSync6 } from "child_process";
 init_errors();
@@ -33624,11 +33889,11 @@ async function ensureFounderFoundryRole(args) {
   });
 }
 function writeWebEnvLocal(args) {
-  const envPath = path45.join(args.repoRoot, "apps", "web", ".env.local");
+  const envPath = path44.join(args.repoRoot, "apps", "web", ".env.local");
   let prior = "";
-  if (fs40.existsSync(envPath)) {
-    prior = fs40.readFileSync(envPath, "utf8");
-    fs40.copyFileSync(envPath, envPath + ".bak");
+  if (fs39.existsSync(envPath)) {
+    prior = fs39.readFileSync(envPath, "utf8");
+    fs39.copyFileSync(envPath, envPath + ".bak");
   }
   const priorSecret = readValidInternalSecret(prior);
   const internalSecret = priorSecret ?? (args.randomBytesImpl ?? randomBytes3)(32).toString("base64url");
@@ -33654,9 +33919,9 @@ function writeWebEnvLocal(args) {
     "NEXT_PUBLIC_M8T_ONBOARDING=1",
     ""
   ].join("\n");
-  fs40.writeFileSync(envPath, body, { encoding: "utf8", mode: 384 });
+  fs39.writeFileSync(envPath, body, { encoding: "utf8", mode: 384 });
   try {
-    fs40.chmodSync(envPath, 384);
+    fs39.chmodSync(envPath, 384);
   } catch {
   }
   return envPath;
@@ -33672,10 +33937,10 @@ function readValidInternalSecret(envText) {
   return isValidInternalSecret(values[0]) ? values[0] : void 0;
 }
 function readWebInternalSecret(repoRoot) {
-  const envPath = path45.join(repoRoot, "apps", "web", ".env.local");
+  const envPath = path44.join(repoRoot, "apps", "web", ".env.local");
   let secret;
   try {
-    secret = readValidInternalSecret(fs40.readFileSync(envPath, "utf8"));
+    secret = readValidInternalSecret(fs39.readFileSync(envPath, "utf8"));
   } catch {
     secret = void 0;
   }
@@ -33727,17 +33992,17 @@ async function installWebDeps(repoRoot) {
   await runInherit("pnpm", ["install"], repoRoot, "BOOTSTRAP_UI_INSTALL_FAILED");
 }
 function onboardingUiPaths(home = os20.homedir()) {
-  const dir = path45.join(home, ".m8t");
+  const dir = path44.join(home, ".m8t");
   return {
-    logPath: path45.join(dir, "onboarding-ui.log"),
-    pidPath: path45.join(dir, "onboarding-ui.pid")
+    logPath: path44.join(dir, "onboarding-ui.log"),
+    pidPath: path44.join(dir, "onboarding-ui.pid")
   };
 }
 function onboardingRelayPaths(home = os20.homedir()) {
-  const dir = path45.join(home, ".m8t");
+  const dir = path44.join(home, ".m8t");
   return {
-    logPath: path45.join(dir, "onboarding-relay.log"),
-    pidPath: path45.join(dir, "onboarding-relay.pid")
+    logPath: path44.join(dir, "onboarding-relay.log"),
+    pidPath: path44.join(dir, "onboarding-relay.pid")
   };
 }
 function isLocalPortOpen(port) {
@@ -33759,7 +34024,7 @@ function isLocalPortOpen(port) {
 }
 function removePidFile(pidPath) {
   try {
-    fs40.unlinkSync(pidPath);
+    fs39.unlinkSync(pidPath);
   } catch {
   }
 }
@@ -33772,7 +34037,7 @@ function parseManagedPid(text) {
 function readLiveManagedPid(pidPath) {
   let text;
   try {
-    text = fs40.readFileSync(pidPath, "utf8").trim();
+    text = fs39.readFileSync(pidPath, "utf8").trim();
   } catch {
     return null;
   }
@@ -33811,8 +34076,8 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs40.mkdirSync(path45.dirname(logPath), { recursive: true });
-  const fd = fs40.openSync(logPath, "a");
+  fs39.mkdirSync(path44.dirname(logPath), { recursive: true });
+  const fd = fs39.openSync(logPath, "a");
   const child = spawn8("pnpm", ["--filter", "web", "dev"], {
     cwd: args.repoRoot,
     detached: true,
@@ -33821,7 +34086,7 @@ async function serveOnboardingUiDetached(args) {
     // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
     shell: process.platform === "win32"
   });
-  fs40.closeSync(fd);
+  fs39.closeSync(fd);
   if (child.pid == null) {
     throw new LocalCliError({
       code: "BOOTSTRAP_UI_DEV_SPAWN_FAILED",
@@ -33830,7 +34095,7 @@ async function serveOnboardingUiDetached(args) {
     });
   }
   child.unref();
-  fs40.writeFileSync(pidPath, String(child.pid), "utf8");
+  fs39.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
   const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
@@ -33862,8 +34127,8 @@ async function serveOnboardingRelayDetached(args) {
     });
   }
   if (managedPid != null) return { alreadyRunning: true, logPath };
-  fs40.mkdirSync(path45.dirname(logPath), { recursive: true });
-  const fd = fs40.openSync(logPath, "a");
+  fs39.mkdirSync(path44.dirname(logPath), { recursive: true });
+  const fd = fs39.openSync(logPath, "a");
   const child = spawn8("pnpm", ["--filter", "web", "exec", "tsx", "voice-relay-entry.ts"], {
     cwd: args.repoRoot,
     detached: true,
@@ -33881,7 +34146,7 @@ async function serveOnboardingRelayDetached(args) {
     // pnpm resolves to pnpm.cmd on Windows, which needs a shell to launch.
     shell: process.platform === "win32"
   });
-  fs40.closeSync(fd);
+  fs39.closeSync(fd);
   if (child.pid == null) {
     throw new LocalCliError({
       code: "BOOTSTRAP_UI_RELAY_SPAWN_FAILED",
@@ -33890,7 +34155,7 @@ async function serveOnboardingRelayDetached(args) {
     });
   }
   child.unref();
-  fs40.writeFileSync(pidPath, String(child.pid), "utf8");
+  fs39.writeFileSync(pidPath, String(child.pid), "utf8");
   const deadline = Date.now() + 45e3;
   const sleep5 = (ms) => new Promise((r) => setTimeout(r, ms));
   while (Date.now() < deadline) {
@@ -33912,7 +34177,7 @@ function autoOpenOnboardingUi(url, open3 = tryOpenUrl) {
 function stopPidFile(pidPath) {
   let pidStr;
   try {
-    pidStr = fs40.readFileSync(pidPath, "utf8").trim();
+    pidStr = fs39.readFileSync(pidPath, "utf8").trim();
   } catch {
     return false;
   }
@@ -33929,7 +34194,7 @@ function stopPidFile(pidPath) {
     }
   }
   try {
-    fs40.unlinkSync(pidPath);
+    fs39.unlinkSync(pidPath);
   } catch {
   }
   return true;
@@ -34256,7 +34521,7 @@ function renderDeployFailure(error) {
 }
 var BootstrapUiCommand = class extends M8tCommand {
   static paths = [["bootstrap", "ui"]];
-  static usage = Command61.Usage({
+  static usage = Command62.Usage({
     description: "Deploy Ezra + start the local onboarding chat UI in the background (returns immediately).",
     details: [
       "Run after `m8t bootstrap launch`, in parallel with `status --watch`. Waits for the cloud",
@@ -34277,16 +34542,16 @@ var BootstrapUiCommand = class extends M8tCommand {
       ["Experimental: start the voice relay (no effect on the text-only intake)", "$0 bootstrap ui --repo-root /path/to/m8t --voice"]
     ]
   });
-  repoRoot = Option58.String("--repo-root");
-  port = Option58.String("--port", "3000");
-  endpoint = Option58.String("--endpoint", {
+  repoRoot = Option59.String("--repo-root");
+  port = Option59.String("--port", "3000");
+  endpoint = Option59.String("--endpoint", {
     description: "Foundry project endpoint to target \u2014 overrides discovery when this install's resource group holds more than one Foundry project."
   });
-  prepOnly = Option58.Boolean("--prep-only", false);
-  skipInstall = Option58.Boolean("--skip-install", false);
-  stop = Option58.Boolean("--stop", false);
-  foreground = Option58.Boolean("--foreground", false);
-  voice = Option58.Boolean("--voice", false, {
+  prepOnly = Option59.Boolean("--prep-only", false);
+  skipInstall = Option59.Boolean("--skip-install", false);
+  stop = Option59.Boolean("--stop", false);
+  foreground = Option59.Boolean("--foreground", false);
+  voice = Option59.Boolean("--voice", false, {
     description: "Experimental: when serving, starts the voice relay and writes the intake voice env var. The onboarding intake is text-only and is unaffected by this flag \u2014 no voice worker is registered for it."
   });
   async executeCommand() {
@@ -34326,10 +34591,10 @@ var BootstrapUiCommand = class extends M8tCommand {
       this.context.stderr.write(`  ${colors.dim(m)}
 `);
     };
-    if (fs41.existsSync(path46.join(os21.homedir(), ".m8t", "config.yaml"))) {
+    if (fs40.existsSync(path45.join(os21.homedir(), ".m8t", "config.yaml"))) {
       out(colors.error("\u26A0 an existing ~/.m8t/config.yaml will override the onboarding app registration in apps/web \u2014 if Microsoft sign-in fails, move it aside and retry."));
     }
-    const credential2 = new DefaultAzureCredential24();
+    const credential2 = new DefaultAzureCredential25();
     const account = await getAzAccount();
     assertNodeVersion();
     out("waiting for Foundry (the installer's foundry-create phase)\u2026");
@@ -34458,10 +34723,10 @@ var BootstrapUiCommand = class extends M8tCommand {
 };
 
 // src/commands/bootstrap/seed-profile.ts
-import { Command as Command62, Option as Option59 } from "clipanion";
+import { Command as Command63, Option as Option60 } from "clipanion";
 var BootstrapSeedProfileCommand = class extends M8tCommand {
   static paths = [["bootstrap", "seed-profile"]];
-  static usage = Command62.Usage({
+  static usage = Command63.Usage({
     description: "Seed your advisors' brains with the founder + company profile from the onboarding intake.",
     details: "Reads the latest onboarding conversation, renders memory/founder.md + memory/company-profile.md (+ their MEMORY.md index lines), and commits them to both <org>/stacey-brain and <org>/ezra-brain via the GitHub App. Idempotent. --watch polls until the founder finishes the intake.",
     examples: [
@@ -34469,11 +34734,11 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
       ["Wait for the founder to finish", "$0 bootstrap seed-profile --watch"]
     ]
   });
-  endpoint = Option59.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
-  brain = Option59.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
-  watch = Option59.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
-  timeout = Option59.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
-  githubAppCreds = Option59.String("--github-app-creds");
+  endpoint = Option60.String("--endpoint", { description: "Override the Foundry endpoint (else read from the install status)." });
+  brain = Option60.String("--brain", { description: "Seed only this one brain repo, instead of both <org>/stacey-brain and <org>/ezra-brain." });
+  watch = Option60.Boolean("--watch", false, { description: "Poll until the intake completes (or --timeout)." });
+  timeout = Option60.String("--timeout", { description: "Watch timeout in minutes (default 20)." });
+  githubAppCreds = Option60.String("--github-app-creds");
   async executeCommand() {
     const ctx = await resolveSeedContext({
       endpointOverride: typeof this.endpoint === "string" ? this.endpoint : void 0,
@@ -34533,10 +34798,10 @@ var BootstrapSeedProfileCommand = class extends M8tCommand {
 };
 
 // src/commands/telemetry/enroll.ts
-import * as fs42 from "fs";
+import * as fs41 from "fs";
 import * as os22 from "os";
-import * as path47 from "path";
-import { Command as Command63, Option as Option60 } from "clipanion";
+import * as path46 from "path";
+import { Command as Command64, Option as Option61 } from "clipanion";
 init_errors();
 
 // src/lib/telemetry-enroll.ts
@@ -34618,7 +34883,7 @@ async function resolveKeyVaultName(containerAppResourceId) {
 }
 var TelemetryEnrollCommand = class extends M8tCommand {
   static paths = [["telemetry", "enroll"]];
-  static usage = Command63.Usage({
+  static usage = Command64.Usage({
     description: "Enroll this installation for operational telemetry (pre-existing installs).",
     details: "Generates an instance id + ingest key from the m8t telemetry ingest and stores the key in your platform Key Vault, the same place the installer writes it on a fresh install. Your installation is identified only by that random instance id \u2014 no contact, company, or subscription details are sent unless you pass them explicitly. Idempotent: refuses if a key already exists.",
     examples: [
@@ -34626,11 +34891,11 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ["Enroll and share a support contact", "$0 telemetry enroll --contact-email you@example.com --company 'Acme'"]
     ]
   });
-  company = Option60.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
-  contactEmail = Option60.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
-  subscription = Option60.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
-  resourceGroup = Option60.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
-  force = Option60.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
+  company = Option61.String("--company", { description: "Share your company name with m8t support. Not sent unless you pass it." });
+  contactEmail = Option61.String("--contact-email", { description: "Share a contact email with m8t support. Not sent unless you pass it." });
+  subscription = Option61.String("--subscription", { description: "Azure subscription id used to find your deployment. Never sent to m8t." });
+  resourceGroup = Option61.String("--resource-group", { description: "Resource group to disambiguate discovery, if you have more than one m8t deployment." });
+  force = Option61.Boolean("--force", false, { description: "Enroll even when a key is already stored. Use only when m8t support asks you to." });
   async executeCommand() {
     const account = await getAzAccount();
     const subscriptionId = (typeof this.subscription === "string" ? this.subscription : void 0) ?? account.subscriptionId;
@@ -34663,13 +34928,13 @@ var TelemetryEnrollCommand = class extends M8tCommand {
       ...company ? { company } : {},
       ...contactEmail ? { contactEmail } : {}
     });
-    const keyDir = fs42.mkdtempSync(path47.join(os22.tmpdir(), "m8t-ingest-key-"));
-    const keyFile = path47.join(keyDir, "key");
+    const keyDir = fs41.mkdtempSync(path46.join(os22.tmpdir(), "m8t-ingest-key-"));
+    const keyFile = path46.join(keyDir, "key");
     try {
-      fs42.writeFileSync(keyFile, ingestKey, { mode: 384 });
+      fs41.writeFileSync(keyFile, ingestKey, { mode: 384 });
       await runAz(["keyvault", "secret", "set", "--vault-name", kvName, "--name", INGEST_KEY_SECRET, "--file", keyFile, "--only-show-errors"]);
     } finally {
-      fs42.rmSync(keyDir, { recursive: true, force: true });
+      fs41.rmSync(keyDir, { recursive: true, force: true });
     }
     this.context.stdout.write(
       `${colors.success("\u2713")} enrolled (instance ${instanceId}); ingest key stored in Key Vault ${kvName}. The gateway picks it up on its next cycle.
@@ -34680,7 +34945,7 @@ var TelemetryEnrollCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/bridge.ts
-import { Command as Command64, Option as Option61 } from "clipanion";
+import { Command as Command65, Option as Option62 } from "clipanion";
 
 // ../../packages/companion-bridge-contract/src/index.ts
 var COMPANION_MESSAGE_MAX_CODE_POINTS = 32768;
@@ -36136,14 +36401,14 @@ async function runCompanionBridge(stdin, stdout, stderr, deps = defaultDeps4) {
     return 3;
   }
 }
-var CompanionBridgeCommand = class extends Command64 {
+var CompanionBridgeCommand = class extends Command65 {
   static paths = [["companion", "_bridge"]];
   /**
    * One process serving many requests instead of one per request, so the
    * session keeps its authenticated context between them. A CLI predating the
    * flag rejects it outright, which is how the app knows to fall back.
    */
-  serve = Option61.Boolean("--serve", false);
+  serve = Option62.Boolean("--serve", false);
   async execute() {
     if (this.serve) {
       return runCompanionBridgeServe(
@@ -36161,7 +36426,7 @@ var CompanionBridgeCommand = class extends Command64 {
 };
 
 // src/commands/companion/status.ts
-import { Command as Command65 } from "clipanion";
+import { Command as Command66 } from "clipanion";
 async function withTimeout(work, ms) {
   let timer;
   try {
@@ -36233,7 +36498,7 @@ Run: m8t companion install
 }
 var CompanionStatusCommand = class extends M8tCommand {
   static paths = [["companion", "status"]];
-  static usage = Command65.Usage({
+  static usage = Command66.Usage({
     description: "Verify the installed desktop companion without launching it."
   });
   async executeCommand() {
@@ -36247,7 +36512,7 @@ var CompanionStatusCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/repair.ts
-import { Command as Command66, Option as Option62 } from "clipanion";
+import { Command as Command67, Option as Option63 } from "clipanion";
 async function runCompanionRepairCommand(stdout, repair) {
   const state = await repair();
   if (state.state === "not-released") {
@@ -36266,10 +36531,10 @@ async function runCompanionRepairCommand(stdout, repair) {
 }
 var CompanionRepairCommand = class extends M8tCommand {
   static paths = [["companion", "repair"]];
-  static usage = Command66.Usage({
+  static usage = Command67.Usage({
     description: "Restore the desktop companions and start-at-login state."
   });
-  resourceGroup = Option62.String("--resource-group", {
+  resourceGroup = Option63.String("--resource-group", {
     description: "Which deployment to bind to, when the subscription holds more than one."
   });
   async executeCommand() {
@@ -36283,7 +36548,7 @@ var CompanionRepairCommand = class extends M8tCommand {
 };
 
 // src/commands/companion/uninstall.ts
-import { Command as Command67 } from "clipanion";
+import { Command as Command68 } from "clipanion";
 async function runCompanionUninstallCommand(stdout, uninstall) {
   const state = await uninstall();
   if (state.state !== "not-installed") {
@@ -36295,7 +36560,7 @@ async function runCompanionUninstallCommand(stdout, uninstall) {
 }
 var CompanionUninstallCommand = class extends M8tCommand {
   static paths = [["companion", "uninstall"]];
-  static usage = Command67.Usage({
+  static usage = Command68.Usage({
     description: "Remove only this user's desktop companion installation."
   });
   async executeCommand() {
@@ -36352,8 +36617,9 @@ cli.register(AzureExecDeployCommand);
 cli.register(PlatformStatusCommand);
 cli.register(PlatformUpdateCommand);
 cli.register(PlatformConvergeCommand);
+cli.register(PlatformClearIntentCommand);
+cli.register(PlatformRequestUpdateCommand);
 cli.register(PlatformSeedStampCommand);
-cli.register(PlatformStampBuildCommand);
 cli.register(PlatformPolicyCommand);
 cli.register(PlatformEnableCostReportCommand);
 cli.register(PlatformEnableAutoUpdateCommand);